[hf-security-analysis]

Automated hardening of the workflow files flagged on #1775.

Warning

This narrows what the workflow can reach. Job permissions were declared in .github/workflows/publish.yml, .github/workflows/tests.yml. Each job now gets only the scopes its steps were read to need — if one of them does something this could not see, it will fail on the next run. The table below says which step drove each scope.

Targets dependabot/github_actions/actions-8340c70952. Files changed, and what changed them:

• .github/workflows/publish.yml — job permissions
• .github/workflows/tests.yml — job permissions

Fixed by this PR:

• MEDIUM excessive-permissions (zizmor) — .github/workflows/publish.yml:1
• MEDIUM excessive-permissions (zizmor) — .github/workflows/publish.yml:11
• MEDIUM excessive-permissions (zizmor) — .github/workflows/tests.yml:1
• MEDIUM excessive-permissions (zizmor) — .github/workflows/tests.yml:21
• MEDIUM excessive-permissions (zizmor) — .github/workflows/tests.yml:45

This does not fix everything. 7 further finding(s) (1 high, 6 medium) need a decision this bot should not make for you. They are in the security channel with their locations — deliberately not repeated here, since this repository may be public and they are not fixed yet.

Permissions

.github/workflows/documentation.yml

build was left as it is — This job only declares uses: to call the external reusable workflow huggingface/doc-builder/.github/workflows/build_main_documentation.yml, whose jobs and their token usage are not visible in this file, so the required permissions cannot be determined here.

.github/workflows/pr-documentation.yml

build was left as it is — This job only calls the external reusable workflow huggingface/doc-builder/.github/workflows/build_pr_documentation.yml, whose jobs and their token usage are not visible in this file, so the required scopes cannot be determined here.

.github/workflows/publish.yml

job	granted	why
build	contents: read	Only actions/checkout needs the token (contents: read); the npm publish step authenticates with the NPM_TOKEN secret, not GITHUB_TOKEN, so no packages scope is required.

.github/workflows/tests.yml

job	granted	why
docs	contents: read	Only actions/checkout needs the token; the remaining steps install pnpm/node, regenerate docs and run a local git diff check, which use no API access.
build	contents: read	actions/checkout drives contents: read; the build, the external git clone from huggingface.co and pnpm test require no GitHub token permissions.

.github/workflows/upload-pr-documentation.yml

build was left as it is — This job only declares uses: to call the external reusable workflow huggingface/doc-builder/.github/workflows/upload_pr_documentation.yml, whose steps are not in this file, so its token needs (likely at least contents read plus pull-requests/issues write for the doc comment bot) cannot be verified here.

Anything not listed above keeps the permissions it had. To measure a job this could not read, add GitHubSecurityLab/actions-permissions/monitor to it and run the workflow — it reports the minimum the run actually used.

Pinning changes come from pinact and are mechanical. Any other change was generated by Claude — read it before merging.

[HuggingFaceDocBuilderDev]

The docs for this PR live here. All of your documentation changes will be reflected on that endpoint. The docs are available until 30 days after the last update.