From 3ea6df4b9634f7a537fbb5515bc6f8cc1de4be47 Mon Sep 17 00:00:00 2001 From: schapron Date: Mon, 21 Sep 2026 14:24:00 +0200 Subject: [PATCH 1/2] build(deps): bump actions/checkout from 7.0.0 to 7.0.1 Bump the actions/checkout pin (9c091bb # v7.0.0 -> 3d3c42e5 # v7.0.1) in the dependency-analysis and gitleaks-analysis reusable workflows, matching dependabot PR #69. Co-Authored-By: Claude Opus 4.8 --- .github/workflows/dependency-analysis.yml | 2 +- .github/workflows/gitleaks-analysis.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/dependency-analysis.yml b/.github/workflows/dependency-analysis.yml index 171b54ac..2ecb41a7 100644 --- a/.github/workflows/dependency-analysis.yml +++ b/.github/workflows/dependency-analysis.yml @@ -15,7 +15,7 @@ jobs: steps: - name: Checkout Repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Check dependencies type and lockfiles version run: | diff --git a/.github/workflows/gitleaks-analysis.yml b/.github/workflows/gitleaks-analysis.yml index f5f83dea..3296295c 100644 --- a/.github/workflows/gitleaks-analysis.yml +++ b/.github/workflows/gitleaks-analysis.yml @@ -10,7 +10,7 @@ jobs: steps: - name: Checkout Repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 From 32ad59c045376dd8d93f470e993c21313cb6ab85 Mon Sep 17 00:00:00 2001 From: schapron Date: Mon, 21 Sep 2026 14:45:06 +0200 Subject: [PATCH 2/2] enh(secu): declare least-privilege token scope on gitleaks-analysis Add a job-level `permissions: contents: read` to the gitleaks reusable workflow so its GITHUB_TOKEN is least-privilege regardless of the caller's default, consistent with dependency-analysis.yml (which already declares its scopes) and the per-job token-scope initiative. contents:read is all the secret scan needs (checkout + read-only git); no PR comment, artifact upload or SARIF write. Co-Authored-By: Claude Opus 4.8 --- .github/workflows/gitleaks-analysis.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/gitleaks-analysis.yml b/.github/workflows/gitleaks-analysis.yml index 3296295c..15ecb857 100644 --- a/.github/workflows/gitleaks-analysis.yml +++ b/.github/workflows/gitleaks-analysis.yml @@ -7,6 +7,8 @@ jobs: secret-scan: name: Run Gitleaks runs-on: ${{ github.repository_visibility != 'public' && (github.repository_owner == 'centreon' && 'centreon-security' || github.repository_owner == 'quanta-computing' && 'quanta-security') || 'ubuntu-24.04' }} + permissions: + contents: read steps: - name: Checkout Repository