$ the-wire · showcase
CREATE-VUE TIGHTENS CI PERMISSIONS
By RepoJournal · Filed · About Vue.js · Composed from the cited sources · methodology
1 person shipped this
Create-vue locked down GitHub Actions token scope to follow least-privilege defaults, reducing attack surface without changing build behavior.
Create-vue merged explicit permission controls into its main CI workflow [1], setting GITHUB_TOKEN to read-only access and eliminating unnecessary privilege creep. The change keeps all current CI functionality intact while making future permission decisions intentional and reviewable. This follows GitHub's security best practice of defaulting to the narrowest token scope needed for each job. It's the kind of quiet infrastructure hardening that prevents supply chain risk down the line.
Action items
- → Review your own GitHub Actions workflows for explicit permission blocks vuejs/create-vue [plan]
References
- [1] chore(ci): set explicit least-privilege workflow permissions ↗ vuejs/create-vue
