[CI] Scope workflow permissions and secret inheritance #49729

Activity

1. thisisnic

   added a parent issue on Apr 14, 2026

   • [CI] Fix problematic CI jobs #49724
2. github-actions

   added

   Component: Continuous Integration

   on Apr 14, 2026
3. thisisnic commented on Apr 14, 2026

   

   thisisnic

   on Apr 14, 2026

   Last edited by thisisnic

   MemberAuthor

   More actions

   I don't think we need this, as we're pinning to SHAs in #49735 so this is already mitigated - what do you think @kou?
4. kou commented on Apr 15, 2026

   

   kou

   on Apr 15, 2026

   Member

   More actions

   * `.github/workflows/package_linux.yml` has `contents: write` at the workflow level — this should be scoped to the specific job that needs it.
   

   We can move

   arrow/.github/workflows/package_linux.yml

   Lines 67 to 68 in 4eca507

   	# Upload to GitHub Release
   	contents: write

   to

   arrow/.github/workflows/package_linux.yml

   Line 79 in 4eca507

   package:

   for this.

   The following workflows pass all secrets to reusable workflows via secrets: inherit instead of explicitly listing required secrets:

   * `.github/workflows/cpp_extra.yml` (2 instances)
   
   * `.github/workflows/cuda_extra.yml` (2 instances)
   
   * `.github/workflows/package_linux.yml` (2 instances)
   
   * `.github/workflows/python.yml`
   
   * `.github/workflows/r.yml`
   

   It seems that python.yml and r.yml doesn't have secrets: inherit.

   Other workflows use https://github.com/apache/arrow/blob/main/.github/workflows/check_labels.yml and https://github.com/apache/arrow/blob/main/.github/workflows/report_ci.yml .

   check_labels needs only github.token.

   report_ci needs only github.token, secrets.ARROW_SMTP_PASSWORD and ${{ secrets.ARROW_ZULIP_WEBHOOK }}.

   So we can list them explicitly instead of using secrets: inherit.

   In general, minimum permissions/secrets are better but the ASF GitHub Actions policy doesn't require them. So these changes are not required. They are just better.

   If you can create a PR with generative AI, let's do them.
5. thisisnic commented on Apr 16, 2026

   

   thisisnic

   on Apr 16, 2026

   MemberAuthor

   More actions

   Thanks! Should be easily automated with genAI, I'll get a PR up
6. github-actions

   assigned

   thisisnic

   on Apr 16, 2026
7. thisisnic

   added a commit that references this issue on Apr 18, 2026

   GH-49729: [CI] Scope workflow permissions and secret inheritance (#49773

   ...

   1cfbb67
8. thisisnic

   added this to the 25.0.0 milestone on Apr 18, 2026
9. thisisnic commented on Apr 18, 2026

   

   thisisnic

   on Apr 18, 2026

   MemberAuthor

   More actions

   Issue resolved by pull request 49773
   #49773
10. thisisnic

    closed this as completedon Apr 18, 2026
11. Mottl

    added a commit that references this issue on May 26, 2026

    apacheGH-49729: [CI] Scope workflow permissions and secret inheritance (

    ...

    d232a48