Summary
Restrict the GitHub Actions token permissions for the Helm chart validation workflow.
Required change
Add an explicit permissions declaration to .github/workflows/helm-ci.yml.
The workflow only checks out repository content and runs Helm lint and template commands. Grant only the required read access:
permissions:
contents: read
Place the declaration at the workflow level or the helm-validate job level. Do not change the existing Helm validation steps.
Rationale
Without an explicit permissions block, the workflow inherits the repository default GITHUB_TOKEN permissions. The workflow does not need write permissions.
Affected area
.github/workflows/helm-ci.yml
Acceptance criteria
- The workflow declares explicit least-privilege token permissions.
- The declaration grants
contents: read only.
- The Helm lint and template validation behavior remains unchanged.
Backlinks
Summary
Restrict the GitHub Actions token permissions for the Helm chart validation workflow.
Required change
Add an explicit
permissionsdeclaration to.github/workflows/helm-ci.yml.The workflow only checks out repository content and runs Helm lint and template commands. Grant only the required read access:
Place the declaration at the workflow level or the
helm-validatejob level. Do not change the existing Helm validation steps.Rationale
Without an explicit
permissionsblock, the workflow inherits the repository defaultGITHUB_TOKENpermissions. The workflow does not need write permissions.Affected area
.github/workflows/helm-ci.ymlAcceptance criteria
contents: readonly.Backlinks