Workflow does not declare permissions

📋 What is this?

A job declares no permissions: block at either the job or the workflow level. Its GITHUB_TOKEN inherits whatever the repo / organisation default is, which is often write-all. Jobs covered by a workflow-level or job-level block are not flagged.

⚠️ Impact

🔧 How to fix

Add a top-level permissions: block listing only the scopes the workflow actually needs. Most workflows only need contents: read.

# .github/workflows/test.yml: ❌ Inherits whatever the repo default is
name: test
on: [push, pull_request]
jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: npm test

# .github/workflows/test.yml: ✅ Least privilege
name: test
on: [push, pull_request]
permissions:
  contents: read
jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - run: npm test

# .plumber.yaml
github:
  controls:
    workflowsMustDeclarePermissions:
      enabled: true

💡 Tips

• Override per-job when a specific job needs more (e.g. release needing contents: write).
• Org admins can also enforce permissions: read-all as the org default, a useful safety net.
• Pair with ISSUE-803 to catch the over-broad case explicitly.

⚙️ Configuration

This control is configured in .plumber.yaml under the github section:

github:
  controls:
    workflowsMustDeclarePermissions:
      enabled: true

See the CLI documentation for the full configuration reference.

🔗 Related issues