From cf1ea65414fd653a3f80f98eb94aca87a04f9551 Mon Sep 17 00:00:00 2001
From: Alex Zenla <alex@edera.dev>
Date: Sat, 26 Sep 2026 20:23:55 -0700
Subject: [PATCH] fix(ci): don't give pull request builds attestation
 permissions

The publish job ran for pull requests with contents: write, id-token:
write, and attestations: write, while running build code from the pull
request. None of these were needed there: uploading artifacts doesn't
need contents: write, and attestation was already skipped for pull
requests. Build with read-only permissions, and attest in a separate
job that only runs on pushes to main.
---
 .github/workflows/publish.yml | 25 ++++++++++++++++++++-----
 1 file changed, 20 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 9bfcc36..a95350f 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -19,10 +19,10 @@ jobs:
   artifacts:
     name: artifacts
     permissions:
-      contents: write # Needed to upload artifacts.
-      id-token: write # Needed for attestation.
-      attestations: write # Needed for attestations.
+      contents: read # Needed to checkout the repository.
     runs-on: ubuntu-latest
+    outputs:
+      artifact-digest: "${{ steps.upload.outputs.artifact-digest }}"
     steps:
     - name: harden runner
       uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
@@ -48,9 +48,24 @@ jobs:
         name: artifacts
         path: target/assemble/*
 
+  # Attestation runs in its own job so that pull requests, which run the build with
+  # code from the pull request, never get the permissions needed to attest.
+  attest:
+    name: attest
+    needs: artifacts
+    if: github.event_name != 'pull_request'
+    permissions:
+      id-token: write # Needed for attestation.
+      attestations: write # Needed for attestations.
+    runs-on: ubuntu-latest
+    steps:
+    - name: harden runner
+      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+      with:
+        egress-policy: audit
+
     - name: 'attest artifacts'
       uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
       with:
         subject-name: artifacts.zip
-        subject-digest: "sha256:${{ steps.upload.outputs.artifact-digest }}"
-      if: github.event_name != 'pull_request'
+        subject-digest: "sha256:${{ needs.artifacts.outputs.artifact-digest }}"