GA-C003: Overly permissive permissions
Warning Security
Why This Matters
Using `permissions: write-all` grants the GITHUB_TOKEN write access to every scope (contents, packages, actions, etc.). If the workflow is compromised via script injection or a malicious action, the attacker gains write access to the entire repository. Always specify the minimum required permissions per scope.
How to Fix
Replace write-all with specific scope permissions
Before (incorrect)
permissions: write-allAfter (correct)
permissions:
contents: read
pull-requests: writeRule Details
- Rule Code
- GA-C003
- Severity
- Warning
- Category
- Security