From 431be5682b5c36977fd416a2931b4387a843614f Mon Sep 17 00:00:00 2001
From: Stephen Morgan <stephen@doublethink.co.nz>
Date: Wed, 2 Apr 2025 16:41:14 +1300
Subject: [PATCH] fix: review actions (#34648)

* fix: possible command injection in docs-lint

* fix: explicit permissions for github actions
---
 .github/workflows/ai-tests.yml              | 3 +++
 .github/workflows/autofix_linters.yml       | 5 +++++
 .github/workflows/avoid-typos.yml           | 3 +++
 .github/workflows/docs-last-changed.yml     | 3 +++
 .github/workflows/docs-lint-v2.yml          | 6 +++---
 .github/workflows/docs-mgmt-api-update.yml  | 4 ++++
 .github/workflows/docs-tests-smoke.yml      | 3 +++
 .github/workflows/docs-tests.yml            | 3 +++
 .github/workflows/fix-typos.yml             | 4 ++++
 .github/workflows/og_images.yml             | 3 +++
 .github/workflows/pg-meta-tests.yml         | 4 ++++
 .github/workflows/prettier.yml              | 3 +++
 .github/workflows/search.yml                | 3 +++
 .github/workflows/self-host-tests-smoke.yml | 3 +++
 .github/workflows/stale.yml                 | 5 +++++
 .github/workflows/studio-e2e-tests.yml      | 3 +++
 .github/workflows/studio-unit-tests.yml     | 3 +++
 .github/workflows/typecheck.yml             | 3 +++
 .github/workflows/ui-patterns-tests.yml     | 3 +++
 .github/workflows/ui-tests.yml              | 3 +++
 20 files changed, 67 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/ai-tests.yml b/.github/workflows/ai-tests.yml
index 64314d44fe7..6684dc0949c 100644
--- a/.github/workflows/ai-tests.yml
+++ b/.github/workflows/ai-tests.yml
@@ -17,6 +17,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/autofix_linters.yml b/.github/workflows/autofix_linters.yml
index 1664da4be70..9b2f1d5c6b5 100644
--- a/.github/workflows/autofix_linters.yml
+++ b/.github/workflows/autofix_linters.yml
@@ -10,9 +10,14 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   autofix:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     if: ${{ github.event_name == 'pull_request' && (github.event.label.name == 'autofix') }}
     steps:
       - name: Calculate number of commits
diff --git a/.github/workflows/avoid-typos.yml b/.github/workflows/avoid-typos.yml
index 01f98f008b9..3a03edd58f5 100644
--- a/.github/workflows/avoid-typos.yml
+++ b/.github/workflows/avoid-typos.yml
@@ -8,6 +8,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   misspell:
     name: runner / misspell
diff --git a/.github/workflows/docs-last-changed.yml b/.github/workflows/docs-last-changed.yml
index 94967a403f2..882e7847367 100644
--- a/.github/workflows/docs-last-changed.yml
+++ b/.github/workflows/docs-last-changed.yml
@@ -10,6 +10,9 @@ on:
         required: false
         type: boolean
 
+permissions:
+  contents: read
+
 jobs:
   deploy:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/docs-lint-v2.yml b/.github/workflows/docs-lint-v2.yml
index a8abcd74eef..6586eb38daf 100644
--- a/.github/workflows/docs-lint-v2.yml
+++ b/.github/workflows/docs-lint-v2.yml
@@ -54,7 +54,7 @@ jobs:
           REVIEWDOG_GITHUB_API_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           set -o pipefail
-          git diff --name-only origin/$BASE_REF HEAD \
+          git diff --name-only "origin/$BASE_REF" HEAD \
             | { grep -E "^apps/docs/content/" || test $? = 1; } \
             | xargs -r supa-mdx-lint --format rdf \
             | reviewdog -f=rdjsonl -reporter=github-pr-review -tee
@@ -67,7 +67,7 @@ jobs:
         run: |
           set -o pipefail
           run_lints() {
-            git diff --name-only origin/$BASE_REF HEAD \
+            git diff --name-only "origin/$BASE_REF" HEAD \
               | { grep -E "^apps/docs/content/" || test $? = 1; } \
               | xargs -rx -n 1000000000 supa-mdx-lint --format markdown
           }
@@ -76,6 +76,6 @@ jobs:
           LINT_EXIT_CODE=$?
           set -e
           if [[ $LINT_EXIT_CODE -ne 0 ]]; then
-            gh pr comment $BRANCH_NAME --body "$LINT_RESULTS"
+            gh pr comment "$BRANCH_NAME" --body "$LINT_RESULTS"
             exit 1
           fi
diff --git a/.github/workflows/docs-mgmt-api-update.yml b/.github/workflows/docs-mgmt-api-update.yml
index f395be7acad..7272f722f36 100644
--- a/.github/workflows/docs-mgmt-api-update.yml
+++ b/.github/workflows/docs-mgmt-api-update.yml
@@ -6,6 +6,10 @@ on:
     - cron: '0 0 * * 1'
   workflow_dispatch:
 
+permissions:
+  pull-requests: write
+  contents: read
+
 jobs:
   update-docs:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/docs-tests-smoke.yml b/.github/workflows/docs-tests-smoke.yml
index c5a38916a46..8dac770f6df 100644
--- a/.github/workflows/docs-tests-smoke.yml
+++ b/.github/workflows/docs-tests-smoke.yml
@@ -11,6 +11,9 @@ concurrency:
   group: ${{ github.workflow }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/docs-tests.yml b/.github/workflows/docs-tests.yml
index f9a36f3cf20..714df8489ec 100644
--- a/.github/workflows/docs-tests.yml
+++ b/.github/workflows/docs-tests.yml
@@ -11,6 +11,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/fix-typos.yml b/.github/workflows/fix-typos.yml
index afded9429c5..84c9bbf4d34 100644
--- a/.github/workflows/fix-typos.yml
+++ b/.github/workflows/fix-typos.yml
@@ -9,6 +9,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+  pull-requests: write
+
 jobs:
   build:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/og_images.yml b/.github/workflows/og_images.yml
index 0e5f03d3fd7..6c2166e7558 100644
--- a/.github/workflows/og_images.yml
+++ b/.github/workflows/og_images.yml
@@ -8,6 +8,9 @@ on:
       - 'supabase/functions/og-images/**'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   deploy:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/pg-meta-tests.yml b/.github/workflows/pg-meta-tests.yml
index 2392fc049c7..7dda782e0f9 100644
--- a/.github/workflows/pg-meta-tests.yml
+++ b/.github/workflows/pg-meta-tests.yml
@@ -15,6 +15,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+  id-token: write
+
 jobs:
   build:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/prettier.yml b/.github/workflows/prettier.yml
index 9381cd0e98e..913d1d07cdb 100644
--- a/.github/workflows/prettier.yml
+++ b/.github/workflows/prettier.yml
@@ -10,6 +10,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   format:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/search.yml b/.github/workflows/search.yml
index 60385047ea4..5831c7d23df 100644
--- a/.github/workflows/search.yml
+++ b/.github/workflows/search.yml
@@ -17,6 +17,9 @@ on:
   schedule:
     - cron: '0 0 * * *'
 
+permissions:
+  contents: read
+
 jobs:
   deploy:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/self-host-tests-smoke.yml b/.github/workflows/self-host-tests-smoke.yml
index dd3d1b76a0c..f5f6066ec35 100644
--- a/.github/workflows/self-host-tests-smoke.yml
+++ b/.github/workflows/self-host-tests-smoke.yml
@@ -11,6 +11,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
index 8281d285e2a..b059f217085 100644
--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -3,6 +3,11 @@ on:
   schedule:
     - cron: '30 1 * * *'
 
+permissions:
+  issues: write
+  pull-requests: write
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/studio-e2e-tests.yml b/.github/workflows/studio-e2e-tests.yml
index 8ae25f750fe..54bbb01d07e 100644
--- a/.github/workflows/studio-e2e-tests.yml
+++ b/.github/workflows/studio-e2e-tests.yml
@@ -20,6 +20,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: write
+
 jobs:
   test:
     timeout-minutes: 60
diff --git a/.github/workflows/studio-unit-tests.yml b/.github/workflows/studio-unit-tests.yml
index 0f41b9e49cf..317ea8dab14 100644
--- a/.github/workflows/studio-unit-tests.yml
+++ b/.github/workflows/studio-unit-tests.yml
@@ -20,6 +20,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   check:
     # Uses larger hosted runner as it significantly decreases build times
diff --git a/.github/workflows/typecheck.yml b/.github/workflows/typecheck.yml
index 76e474371a1..9359a3b79c0 100644
--- a/.github/workflows/typecheck.yml
+++ b/.github/workflows/typecheck.yml
@@ -10,6 +10,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   typecheck:
     # Uses larger hosted runner as it significantly decreases build times
diff --git a/.github/workflows/ui-patterns-tests.yml b/.github/workflows/ui-patterns-tests.yml
index 1f5b93696d8..766466ee0a8 100644
--- a/.github/workflows/ui-patterns-tests.yml
+++ b/.github/workflows/ui-patterns-tests.yml
@@ -11,6 +11,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/ui-tests.yml b/.github/workflows/ui-tests.yml
index 80b75b974cd..c579d052023 100644
--- a/.github/workflows/ui-tests.yml
+++ b/.github/workflows/ui-tests.yml
@@ -11,6 +11,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest