GitHub Actions workflow updates - #3628
Merged
Merged
Conversation
johnbillion
requested review from
a team,
adamziel,
Copilot,
desrosj and
zaerl
and removed request for
Copilot
May 13, 2026 14:58
desrosj
approved these changes
May 13, 2026
Contributor
There was a problem hiding this comment.
Pull request overview
Note
Copilot was unable to run its full agentic suite in this review.
Updates GitHub Actions workflows to follow least-privilege permissions and to add explicit job-level timeouts to prevent runaway jobs.
Changes:
- Set workflow-level default token permissions to none (
permissions: {}) and add job-level permissions as needed. - Add
timeout-minutesto jobs across workflows. - Document rationale for permissions/timeouts inline within workflow files.
Reviewed changes
Copilot reviewed 14 out of 14 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
| .github/workflows/update-changelog.yml | Disables default permissions; adds job timeout and contents: write for changelog updates. |
| .github/workflows/refresh-wordpress-nightly.yml | Disables default permissions; adds timeout and contents: write for scheduled refresh pushes. |
| .github/workflows/refresh-wordpress-major-and-beta.yml | Disables default permissions; sets job permissions for repo writes and workflow dispatch. |
| .github/workflows/refresh-sqlite-integration.yml | Disables default permissions; adds timeout and permissions for repo writes + workflow dispatch. |
| .github/workflows/publish-self-hosted-package-release.yml | Disables default permissions; adds timeout and contents: write for tagging/version bumps. |
| .github/workflows/publish-npm-packages.yml | Moves permissions from workflow-level to job-level; adds timeout and OIDC permissions. |
| .github/workflows/publish-github-release.yml | Moves permissions from workflow-level to job-level; adds timeout and contents: write. |
| .github/workflows/publish-devtools-extension.yml | Disables default permissions; adds timeout and clarifies contents: write usage. |
| .github/workflows/deploy-website.yml | Disables default permissions; adds timeouts and job-level contents: read where needed. |
| .github/workflows/deploy-my-wordpress-net.yml | Disables default permissions; adds timeouts and job-level contents: read where needed. |
| .github/workflows/deploy-cors-proxy.yml | Disables default permissions; adds timeouts and job-level contents: read where needed. |
| .github/workflows/dependabot-lockfile.yml | Moves permissions from workflow-level to job-level; adds timeout and contents: write. |
| .github/workflows/ci.yml | Disables default permissions; adds job timeouts and contents: read across CI jobs; adjusts Pages deploy permissions. |
| .github/workflows/auto-label-prs.yml | Moves permissions from workflow-level to job-level; adds timeouts and least-privilege permissions. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Collaborator
|
This seems mostly sound to me. I had Codex scrutinize the workflow changes and found two small things worth tightening before merge:
I pushed e62869e with those changes and will monitor what happens after the merge. |
Member
|
Thanks @adamziel!
I've gone and changed this setting on the repository. |
adamziel
pushed a commit
that referenced
this pull request
Jul 1, 2026
## Motivation for the change, related issues Every release since v3.1.34 has been published with empty `CHANGELOG.md` sections and "No changelog entries for this release." in the GitHub release body, even though merged PRs exist in every window. Follow-up on #3628. That PR tightened `update-changelog.yml` to an explicit per-job allowlist for least-privilege, granting `contents: write` and `issues: read` but not `pull-requests: read`. `packages/meta/src/changelog.ts` calls `octokit.issues.listForRepo` and filters with `pull.pull_request?.merged_at`. The issues endpoint strips the `pull_request` field when the token lacks `pull-requests` permission, so every PR is dropped and the script writes only the version headline. The v3.1.34 run still had `PullRequests: write` from the default token; v3.1.39's run shows `Contents: write`, `Issues: read`, `Metadata: read` only. ## Implementation details Add `pull-requests: read` to the job-level permissions in `.github/workflows/update-changelog.yml`. Minimum scope the changelog script needs. ## Testing Instructions (or ideally a Blueprint) 1. Trigger the `Release NPM packages` workflow manually (or wait for the Monday cron). 2. Wait for `Update CHANGELOG.md` to complete. 3. Verify the new section in `CHANGELOG.md` contains the merged PRs grouped by section instead of being empty. 4. Verify the GitHub release body posts those same entries instead of "No changelog entries for this release." Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This updates the GitHub Actions workflow files to:
Once this PR is merged, the Settings -> Actions -> Workflow permissions setting can be changed by a repo admin to "Read repository contents and packages permissions".
References
Use of AI
Claude Code was used to create the initial changes. All permissions and timeouts changes were reviewed and adjusted by me where necessary.