Repository: stravalib/stravalib
Pull request #648 (2025-06-18 15:29:31)

chore(ci): narrow permissions used in actions
## Description

Narrows permissions used in GitHub Actions to only what is needed to run.

Refs: https://docs.zizmor.sh/audits/#excessive-permissions

## Type of change

Select the statement best describes this pull request.

- [x] This is a infrastructure update (docs, ci, etc)

## Does your PR include tests

If you are fixing a bug or adding a feature, we appreciate (but do not require)
tests to support whatever fix of feature you're implementing.

- [x] This change doesn't require tests

## Did you include your contribution to the change log?

- [x] Yes, `changelog.md` is up-to-date.


codecov[bot]: ## [Codecov](https://app.codecov.io/gh/stravalib/stravalib/pull/648?dropdown=coverage&src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=stravalib) Report
All modified and coverable lines are covered by tests :white_check_mark:
> Project coverage is 90.77%. Comparing base [(`08f8eb0`)](https://app.codecov.io/gh/stravalib/stravalib/commit/08f8eb01a25504d281e246eb8271ffa06b1761ed?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=stravalib) to head [(`800e9b8`)](https://app.codecov.io/gh/stravalib/stravalib/commit/800e9b84ded84c28cfff279a03e77470e66b1c37?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=stravalib).

<details><summary>Additional details and impacted files</summary>


```diff
@@           Coverage Diff           @@
##             main     #648   +/-   ##
=======================================
  Coverage   90.77%   90.77%           
=======================================
  Files           9        9           
  Lines        1973     1973           
  Branches      144      144           
=======================================
  Hits         1791     1791           
  Misses        142      142           
  Partials       40       40           
```

</details>

[:umbrella: View full report in Codecov by Sentry](https://app.codecov.io/gh/stravalib/stravalib/pull/648?dropdown=coverage&src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=stravalib).   
:loudspeaker: Have feedback on the report? [Share it here](https://about.codecov.io/codecov-pr-comment-feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=stravalib).

<details><summary> :rocket: New features to boost your workflow: </summary>

- :snowflake: [Test Analytics](https://docs.codecov.com/docs/test-analytics): Detect flaky tests, report on failures, and find test suite problems.
</details>

Patch:
diff --git a/.github/workflows/build-docs.yml b/.github/workflows/build-docs.yml
index 56b465e..d672ebd 100644
--- a/.github/workflows/build-docs.yml
+++ b/.github/workflows/build-docs.yml
@@ -6,6 +6,8 @@ on:
     branches:
       - main
 
+permissions: {}
+
 jobs:
   build-doc:
     runs-on: ubuntu-latest
@@ -13,6 +15,9 @@ jobs:
       PYTHON-VERSION: "3.11"
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          fetch-depth: 20
+          persist-credentials: false
       - name: Setup Python
         uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
diff --git a/.github/workflows/check-strava-api.yml b/.github/workflows/check-strava-api.yml
index 7230a38..7d24d20 100644
--- a/.github/workflows/check-strava-api.yml
+++ b/.github/workflows/check-strava-api.yml
@@ -5,12 +5,16 @@ on:
     - cron: "0 0 * * *"
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
   update-model:
     name: Update Model
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
       - name: Fetch API
         run: curl https://developers.strava.com/swagger/swagger.json > src/stravalib/tests/resources/strava_swagger.json
       - name: Fetch API Schema
diff --git a/.github/workflows/publish-pypi.yml b/.github/workflows/publish-pypi.yml
index 48b130f..3cc63cf 100644
--- a/.github/workflows/publish-pypi.yml
+++ b/.github/workflows/publish-pypi.yml
@@ -5,6 +5,10 @@ on:
   push:
     branches:
       - main
+
+permissions:
+  contents: "read"
+
 jobs:
   build:
     runs-on: ubuntu-latest
@@ -17,6 +21,7 @@ jobs:
         with:
           # So scm can view previous commits
           fetch-depth: 100
+          persist-credentials: false
 
       # Need the tags so that setuptools-scm can form a valid version number
       - name: Fetch git tags
diff --git a/.github/workflows/type-check.yml b/.github/workflows/type-check.yml
index 3646807..600bc09 100644
--- a/.github/workflows/type-check.yml
+++ b/.github/workflows/type-check.yml
@@ -11,6 +11,8 @@ defaults:
   run:
     shell: bash
 
+permissions: {}
+
 jobs:
   mypy:
     name: Run mypy
@@ -20,6 +22,9 @@ jobs:
 
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          fetch-depth: 20
+          persist-credentials: false
       - name: Set up Python 3.11
         uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
diff --git a/changelog.md b/changelog.md
index 69e5b02..245eeaf 100644
--- a/changelog.md
+++ b/changelog.md
@@ -9,6 +9,7 @@
 - Add: allow silencing of warning about missing environment variables (@kevsteramp, @jsamoocha, #643)
 - Fix: Pin GHA dependencies throughout to optimize security (@miketheman, #645)
 - Fix: Update Dependabot config to also update GitHub Actions dependencies (@miketheman, #646)
+- Fix: Narrow permissions used in GitHub Actions workflows (@miketheman, #648)
 
 ## v2.3.0
 


Test patch:
diff --git a/.github/workflows/build-test.yml b/.github/workflows/build-test.yml
index 105fc51..a68365d 100644
--- a/.github/workflows/build-test.yml
+++ b/.github/workflows/build-test.yml
@@ -11,6 +11,8 @@ defaults:
   run:
     shell: bash
 
+permissions: {}
+
 jobs:
   build-test:
     name: Test Run (${{ matrix.python-version }}, ${{ matrix.os }})
@@ -26,6 +28,7 @@ jobs:
         with:
           # fetch more than the last single commit to help scm generate proper version
           fetch-depth: 20
+          persist-credentials: false
       - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with: