Skip to content

fix(ci): scope GITHUB_TOKEN permissions per job (#15046) - #15048

Open
hf-security-analysis[bot] wants to merge 38 commits into
mainfrom
security/workflow-hardening/pr-15046-permissions
Open

fix(ci): scope GITHUB_TOKEN permissions per job (#15046)#15048
hf-security-analysis[bot] wants to merge 38 commits into
mainfrom
security/workflow-hardening/pr-15046-permissions

Conversation

@hf-security-analysis

@hf-security-analysis hf-security-analysis Bot commented Oct 15, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Automated hardening of the workflow files flagged on #15046: job permissions only.

Each kind of fix has its own pull request, from a security/workflow-hardening/pr-15046-* branch, and any of them can be merged first: the others are rebuilt on top when this one lands.

Warning

This changes when the workflow runs and what it can reach. Both triggers and permissions were rewritten in .github/workflows/issue_labeler.yml, .github/workflows/pr_labeler.yml. Read the diff before merging — either one can change what the workflow is able to do.

Targets flux3-image. Files changed, and what changed them:

  • .github/workflows/issue_labeler.yml — job permissions
  • .github/workflows/pr_labeler.yml — job permissions

Fixed by this PR:

  • HIGH excessive-permissions (zizmor) — .github/workflows/issue_labeler.yml:9
  • HIGH excessive-permissions (zizmor) — .github/workflows/pr_labeler.yml:9

This does not fix everything. 3 further finding(s) (3 medium) need a decision this bot should not make for you. They are in the security channel with their locations — deliberately not repeated here, since this repository may be public and they are not fixed yet.

Permissions

.github/workflows/codeql.yml

codeql was left as it is — Job only calls the external reusable workflow huggingface/security-workflows/.github/workflows/codeql-reusable.yml, whose steps are not in this file; its existing grant (security-events: write for SARIF upload, actions/contents/packages: read) looks plausible for CodeQL but cannot be verified here.

.github/workflows/issue_labeler.yml

job granted why
label contents: read, issues: write The 'Apply labels' step runs gh issue edit --add-label with GITHUB_TOKEN, which needs issues: write, and actions/checkout needs contents: read; the local script utils/label_issues.py receives no GitHub token (only HF_TOKEN), so it cannot drive any further scope.

.github/workflows/pr_labeler.yml

job granted why
label contents: read, pull-requests: write actions/labeler reads the labeler config from the repository (contents: read) and adds/removes PR labels with sync-labels (pull-requests: write).
missing-tests contents: read, pull-requests: write The gh pr edit --add-label/--remove-label step needs pull-requests: write and checkout needs contents: read; utils/check_test_missing.py is not in this file but only receives the PR file list on stdin, so a reviewer may want to confirm it makes no API calls of its own.
fixes-issue issues: read, pull-requests: write gh pr edit label changes need pull-requests: write, and the GraphQL closingIssuesReferences query reads linked issues, so issues: read is included (check this one; it may be unnecessary on public repositories).
size-label pull-requests: write Reads PR diff stats and labels via gh api repos/.../pulls and .../issues/.../labels, then adds/removes size labels with gh pr edit, which needs pull-requests: write.

.github/workflows/pr_link_issue_reminder.yml

remind was left as it is — The Run reminder script step runs python utils/remind_link_issue.py with GITHUB_TOKEN. That script is not in this file, so its API calls cannot be verified. The job's comment says it comments on and closes PRs, which suggests the existing contents: read, pull-requests: write and issues: write, but that is unconfirmed.

.github/workflows/stale.yml

job granted why
close_stale_issues contents: read, issues: write, pull-requests: write The 'Close stale issues' step runs utils/stale.py via PyGithub, which is not in this file; its name and the job's existing grants indicate it comments on, labels and closes stale issues and PRs (issues: write, pull-requests: write), and actions/checkout needs contents: read, so the reviewer should confirm the script does nothing beyond that.

Anything not listed above keeps the permissions it had. To measure a job this could not read, add GitHubSecurityLab/actions-permissions/monitor to it and run the workflow — it reports the minimum the run actually used.

Claude decided the scopes each job needs; the YAML was edited by code. Read the table below before merging.

dependabot Bot and others added 30 commits September 18, 2026 17:13
@dependabot
Bump the actions group with 17 updates (#12)
6b089c2 
Bumps the actions group with 17 updates:

| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `6` | `7` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4.6.2` | `7.0.1` |
| [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) | `3.12.0` | `4.2.0` |
| [docker/login-action](https://github.com/docker/login-action) | `3.7.0` | `4.6.0` |
| [docker/build-push-action](https://github.com/docker/build-push-action) | `6.19.2` | `7.3.0` |
| [huggingface/doc-builder/.github/workflows/build_main_documentation.yml](https://github.com/huggingface/doc-builder) | `e60a538eea9817ab312196d0d233604b01697265` | `af49b8dc3859c3d80c7220c8c0ba146431132e49` |
| [actions/setup-python](https://github.com/actions/setup-python) | `5.6.0` | `7.0.0` |
| [huggingface/doc-builder/.github/workflows/build_pr_documentation.yml](https://github.com/huggingface/doc-builder) | `e60a538eea9817ab312196d0d233604b01697265` | `af49b8dc3859c3d80c7220c8c0ba146431132e49` |
| [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) | `1.0.155` | `1.0.193` |
| [huggingface/security-workflows/.github/workflows/codeql-reusable.yml](https://github.com/huggingface/security-workflows) | `1.1.0` | `1.2.0` |
| [actions/download-artifact](https://github.com/actions/download-artifact) | `4.3.0` | `8.0.1` |
| [actions/labeler](https://github.com/actions/labeler) | `5.0.0` | `7.0.0` |
| [pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish) | `1.13.0` | `1.14.2` |
| [huggingface/tailscale-action](https://github.com/huggingface/tailscale-action) | `7d53c9737e53934c30290b5524d1c9b4a7c98c8a` | `07d36e4c3b68707bd3fe070dbb96f03f993a6efd` |
| [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) | `3.94.2` | `3.97.0` |
| [crate-ci/typos](https://github.com/crate-ci/typos) | `1.42.1` | `1.49.0` |
| [huggingface/doc-builder/.github/workflows/upload_pr_documentation.yml](https://github.com/huggingface/doc-builder) | `9ad2de8582b56c017cb530c1165116d40433f1c6` | `af49b8dc3859c3d80c7220c8c0ba146431132e49` |


Updates `actions/checkout` from 6 to 7
- [Release notes](https://github.com/actions/checkout/releases)
- [Commits](actions/checkout@v6...v7)

Updates `actions/upload-artifact` from 4.6.2 to 7.0.1
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@v4.6.2...v7.0.1)

Updates `docker/setup-buildx-action` from 3.12.0 to 4.2.0
- [Release notes](https://github.com/docker/setup-buildx-action/releases)
- [Commits](docker/setup-buildx-action@8d2750c...bb05f3f)

Updates `docker/login-action` from 3.7.0 to 4.6.0
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](docker/login-action@c94ce9f...dbcb813)

Updates `docker/build-push-action` from 6.19.2 to 7.3.0
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](docker/build-push-action@10e90e3...53b7df9)

Updates `huggingface/doc-builder/.github/workflows/build_main_documentation.yml` from e60a538eea9817ab312196d0d233604b01697265 to af49b8dc3859c3d80c7220c8c0ba146431132e49
- [Release notes](https://github.com/huggingface/doc-builder/releases)
- [Commits](huggingface/doc-builder@e60a538...af49b8d)

Updates `actions/setup-python` from 5.6.0 to 7.0.0
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](actions/setup-python@v5.6.0...v7)

Updates `huggingface/doc-builder/.github/workflows/build_pr_documentation.yml` from e60a538eea9817ab312196d0d233604b01697265 to af49b8dc3859c3d80c7220c8c0ba146431132e49
- [Release notes](https://github.com/huggingface/doc-builder/releases)
- [Commits](huggingface/doc-builder@e60a538...af49b8d)

Updates `anthropics/claude-code-action` from 1.0.155 to 1.0.193
- [Release notes](https://github.com/anthropics/claude-code-action/releases)
- [Commits](anthropics/claude-code-action@80b3182...9d7150b)

Updates `huggingface/security-workflows/.github/workflows/codeql-reusable.yml` from 1.1.0 to 1.2.0
- [Release notes](https://github.com/huggingface/security-workflows/releases)
- [Commits](huggingface/security-workflows@dc6ca34...e0d40aa)

Updates `actions/download-artifact` from 4.3.0 to 8.0.1
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](actions/download-artifact@v4.3.0...3e5f45b)

Updates `actions/labeler` from 5.0.0 to 7.0.0
- [Release notes](https://github.com/actions/labeler/releases)
- [Commits](actions/labeler@8558fd7...bf12e9b)

Updates `pypa/gh-action-pypi-publish` from 1.13.0 to 1.14.2
- [Release notes](https://github.com/pypa/gh-action-pypi-publish/releases)
- [Commits](pypa/gh-action-pypi-publish@ed0c539...dc37677)

Updates `huggingface/tailscale-action` from 7d53c9737e53934c30290b5524d1c9b4a7c98c8a to 07d36e4c3b68707bd3fe070dbb96f03f993a6efd
- [Release notes](https://github.com/huggingface/tailscale-action/releases)
- [Commits](huggingface/tailscale-action@7d53c97...07d36e4)

Updates `trufflesecurity/trufflehog` from 3.94.2 to 3.97.0
- [Release notes](https://github.com/trufflesecurity/trufflehog/releases)
- [Commits](trufflesecurity/trufflehog@6bd2d14...bcfcf73)

Updates `crate-ci/typos` from 1.42.1 to 1.49.0
- [Release notes](https://github.com/crate-ci/typos/releases)
- [Changelog](https://github.com/crate-ci/typos/blob/master/CHANGELOG.md)
- [Commits](crate-ci/typos@6512063...8a48f81)

Updates `huggingface/doc-builder/.github/workflows/upload_pr_documentation.yml` from 9ad2de8582b56c017cb530c1165116d40433f1c6 to af49b8dc3859c3d80c7220c8c0ba146431132e49
- [Release notes](https://github.com/huggingface/doc-builder/releases)
- [Commits](huggingface/doc-builder@9ad2de8...af49b8d)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: actions/upload-artifact
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: docker/setup-buildx-action
  dependency-version: 4.2.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: docker/login-action
  dependency-version: 4.6.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: docker/build-push-action
  dependency-version: 7.3.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: huggingface/doc-builder/.github/workflows/build_main_documentation.yml
  dependency-version: af49b8dc3859c3d80c7220c8c0ba146431132e49
  dependency-type: direct:production
  dependency-group: actions
- dependency-name: actions/setup-python
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: huggingface/doc-builder/.github/workflows/build_pr_documentation.yml
  dependency-version: af49b8dc3859c3d80c7220c8c0ba146431132e49
  dependency-type: direct:production
  dependency-group: actions
- dependency-name: anthropics/claude-code-action
  dependency-version: 1.0.193
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: huggingface/security-workflows/.github/workflows/codeql-reusable.yml
  dependency-version: 1.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: actions/download-artifact
  dependency-version: 8.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: actions/labeler
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: pypa/gh-action-pypi-publish
  dependency-version: 1.14.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: huggingface/tailscale-action
  dependency-version: 07d36e4c3b68707bd3fe070dbb96f03f993a6efd
  dependency-type: direct:production
  dependency-group: actions
- dependency-name: trufflesecurity/trufflehog
  dependency-version: 3.97.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: crate-ci/typos
  dependency-version: 1.49.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: huggingface/doc-builder/.github/workflows/upload_pr_documentation.yml
  dependency-version: af49b8dc3859c3d80c7220c8c0ba146431132e49
  dependency-type: direct:production
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@hf-security-analysis
Scope GITHUB_TOKEN permissions per job (#16)
5fffb56 
A job with no `permissions:` block inherits whatever the repository
hands out. Each block added here grants what that job's own steps
need and nothing more.

Co-authored-by: hf-security-analysis[bot] <265538906+hf-security-analysis[bot]@users.noreply.github.com>
@hf-security-analysis
Pin GitHub Actions to commit SHAs (#17)
ab98af5 
A tag is mutable: whoever controls the action's repository can move
`v4` to different code, and the next run picks it up with no diff to
review. Pinning to the commit SHA freezes the code that runs today.

Co-authored-by: hf-security-analysis[bot] <265538906+hf-security-analysis[bot]@users.noreply.github.com>
@paulinebm @claude
Bump doc-builder workflow pin (#22)
0f8a86a 
* Bump doc-builder pin to 9fc8a41 in build_documentation.yml

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* Bump doc-builder pin to 9fc8a41 in build_pr_documentation.yml

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* Bump doc-builder pin to 9fc8a41 in upload_pr_documentation.yml

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
@yiyixuxu @claude
Add FLUX.3 image: Flux3Transformer2DModel and modular text-to-image /…
fc63b64 
… image-to-image pipeline

Adds the FLUX.3 image transformer, the modular pipeline (text-to-image and image-to-image with one
prompt per call and one or more reference images), Flux3ImageProcessor, the converter for BFL's
model package, tests and docs. Verified against BFL's reference on the real checkpoint
(integration-notes/parity_bf16.py, temporary folder).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
@yiyixuxu @claude
integration-notes: ship the knight example image with the doc examples
41ff90d 
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
@yiyixuxu @claude
integration-notes: drop the tokenizer config workaround (not needed w…
c894120 
…ith transformers 5.x)

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
@yiyixuxu @claude
Address review: rename the mode channel dict and the final norm, name…
0a77413 
… the reference workflow

image_conditioned, document the guidance scale

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
@yiyixuxu @claude
Add the step-distilled FLUX.3 image model (flow map)
be15632 
- transformer: `flow_map` config and `target_timestep_embedder`; forward takes
  `target_timestep` (the timestep each step jumps to), added to the modulation
  of every mode and the final layer
- convert script: map `ref_time_in.*` and read `flow_map` from the package config
- modular: dedicated `Flux3Distilled*` blocks (text encoder, text input, text
  RoPE inputs, denoiser) with no guider and no negative prompt, 16 steps by
  default; `Flux3DistilledAutoBlocks` and `Flux3DistilledModularPipeline`
- tests for the flow-map transformer path and the distilled modular pipeline
- docs: step-distilled section and autodoc entries

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
@yiyixuxu @claude
Add the step-distilled examples script
ef53f7b 
Same four cases as flux3_examples.py, run against the distilled Hub repo.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
@sayakpaul
feat: add a single file support in Flux3 image. (#32)
9f6e4c4
@yiyixuxu @claude
Merge branch 'flux3-image' into flux3-image-distilled
6b1ac51 
Resolve the conversion-script conflict: the key mapping now lives in single_file_utils, so the step-distilled ref_time_in -> target_timestep_embedder entries move there too, and the flow_map config line stays in the script.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
@yiyixuxu
Merge pull request #29 from huggingface/flux3-image-distilled
c224b3e 
Add the step-distilled FLUX.3 image model (flow map)
@yiyixuxu @claude
Warn about the denoiser input fields that are not passed to the trans…
6a17c32 
…former

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
@yiyixuxu @claude
Document reproducible generation with user-provided latents
a88c209 
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
@yiyixuxu @claude
Run the QK norm and RoPE in fp32 with a single cast back, matching th…
26a32da 
…e BFL implementation

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
@yiyixuxu @claude
parity script: run against the Hub repos and print the imported diffu…
6348cc0 
…sers source

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
@yiyixuxu @claude
Wrap a forward docstring line for the doc-builder style check
9d6eccf 
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
@sayakpaul
support lora loading (including ostris) in flux3 image pipeline. (#25)
4655c6c
@sayakpaul @claude
feat: support loading and performing inference with single-file forma…
f97b920 
…tted FP8 and NVFP4 checkpoints (#24)

* feat: support loading siungle file format checkpoints including quants.

* remove updates.patch

* remove fluff.

* feat: add a single file support in Flux3 image.

* bfl prefix

* version guard.

* prpoagate changes.

* add tests

* doc mods and remove integration notes

* remove script for quant

---------

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
@linoytsaban
add LoRA training for Flux 3 image small
4430857
@linoytsaban
tests: clarify FLUX3_TINY_REPO comment
64777c3 
The tiny repo is uploaded to hf-internal-testing and the env var is a
local-dev escape hatch, not a pre-PR TODO.
@linoytsaban
examples/flux3: drop unused args and dead class
a4e8261 
Remove the text-encoder weight-decay arg from both trainers (neither
trains the text encoder) and, from the img2img trainer, the
prior-preservation leftovers (--class_data_dir, --sample_batch_size,
PromptDataset) that it never uses.
@linoytsaban
bump yarn example rank to 32 in flux3 small readme
8af9ae4
@apolinario
Document <ref_image_n> references and layout prompts for FLUX.3
c870eb8 
Matches the prompt grammar in BFL's reference inference code (bfl-hf-flux3-confidential#3): references are addressed as <ref_image_n> in the order passed to image, and regions can be placed with a trailing JSON list of id / bbox / desc (from / src_bbox / tgt_bbox when editing).
@apolinario
Merge pull request #36 from huggingface/flux3-ref-image-prompting
b2d4917 
Document <ref_image_n> references and layout prompts for FLUX.3
@linoytsaban
examples/flux3: set klein model id, document ref image prompts, clean…
6d57817 
… leftover refs
@linoytsaban
point flux3 image docs at the klein release model ids
062061e
@linoytsaban
Merge pull request #37 from huggingface/flux3-klein-refs
44afdae 
point flux3 image docs at the klein release model ids
@linoytsaban
Merge pull request #28 from huggingface/flux3-small-lora-training
5241bfc 
add LoRA training for Flux 3 image small
sayakpaul and others added 8 commits October 15, 2026 08:54
@sayakpaul
fix: TestFlux3DistilledModularPipelineWorkflow::test_workflow_default…
1f913d4 
…s test (#35)
@sayakpaul
fix checkpoint ids in the flux3 docs. (#38)
fb51c15
@ariG23498
[docs] update pipe loading with vae fp32 dtype (#39)
c0ddc02 
* update pipe loading with vae fp32 dtype

* updating `load_componenets`
@sayakpaul
use actual ckpts. (#42)
ac36f1f
@linoytsaban
flux3 klein example: rename from "small" and fix caption dropout for …
dc356dc 
…long prompts (#41)

* examples/flux3: rename small trainer, tests and readme files to klein

* examples/flux3: fix caption dropout shape mismatch for prompts longer than the pad window

* examples/flux3: add caption dropout to the i2i trainer

* examples/flux3: complete the klein rename (test class names, example output dirs)

* examples/flux3: guard against train_batch_size>1 with variable-length captions
@YumengLi007
update flux3.md (#43)
4d3b9f6
@linoytsaban
examples/flux3: support train_batch_size>1 and prior preservation wit…
df5e606 
…h variable-length captions (#44)
@hf-security-analysis
fix(ci): scope job permissions in workflows flagged on #15046
bc78dd2
@github-actions github-actions Bot added CI size/S PR with diff < 50 LOC labels Oct 15, 2026
Base automatically changed from flux3-image to main October 15, 2026 16:30

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@paulinebm paulinebm Awaiting requested review from paulinebm

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

CI size/S PR with diff < 50 LOC

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

7 participants

@paulinebm @yiyixuxu @sayakpaul @linoytsaban @apolinario @ariG23498 @YumengLi007