From 2924431f25a7d035cbc81d7079067c00470f5ddf Mon Sep 17 00:00:00 2001 From: Alexander Tarasov Date: Tue, 4 Aug 2026 16:13:12 +0200 Subject: [PATCH 1/2] ci: Remove secrets: inherit from changelog-preview workflow The reusable getsentry/craft changelog-preview.yml workflow only uses the auto-provisioned GITHUB_TOKEN and doesn't declare any workflow_call secrets. Inheriting all repository secrets into it violates least privilege and isn't needed to make the workflow function. Refs VULN-2352 Co-Authored-By: Claude Sonnet 5 --- .github/workflows/changelog-preview.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/.github/workflows/changelog-preview.yml b/.github/workflows/changelog-preview.yml index 2f683bd..5a5d627 100644 --- a/.github/workflows/changelog-preview.yml +++ b/.github/workflows/changelog-preview.yml @@ -16,4 +16,3 @@ permissions: jobs: changelog-preview: uses: getsentry/craft/.github/workflows/changelog-preview.yml@f4889d04564e47311038ecb6b910fef6b6cf1363 # v2 - secrets: inherit From e634ab76b659a517d4ba8b2d3f8f5c92fba0e0b0 Mon Sep 17 00:00:00 2001 From: Alexander Tarasov Date: Tue, 4 Aug 2026 22:27:34 +0200 Subject: [PATCH 2/2] ci: Remove disabled changelog-preview workflow changelog-preview.yml is disabled_manually on GitHub and unused. Rather than fixing its secrets: inherit usage, remove the workflow entirely, consistent with how other getsentry repos are dropping this disabled workflow. Refs VULN-2352 Co-Authored-By: Claude Sonnet 5 --- .github/workflows/changelog-preview.yml | 18 ------------------ 1 file changed, 18 deletions(-) delete mode 100644 .github/workflows/changelog-preview.yml diff --git a/.github/workflows/changelog-preview.yml b/.github/workflows/changelog-preview.yml deleted file mode 100644 index 5a5d627..0000000 --- a/.github/workflows/changelog-preview.yml +++ /dev/null @@ -1,18 +0,0 @@ -name: Changelog Preview -on: - pull_request_target: - types: - - opened - - synchronize - - reopened - - edited - - labeled - - unlabeled -permissions: - contents: write - pull-requests: write - statuses: write - -jobs: - changelog-preview: - uses: getsentry/craft/.github/workflows/changelog-preview.yml@f4889d04564e47311038ecb6b910fef6b6cf1363 # v2