Back to Checks
github

Organization grants workflows a read-only default GITHUB_TOKEN

organization_default_workflow_permissions_read_only
Service: organizationSeverity: high
OfficialBuilt-inVerified
Categories:ci-cdsoftware-supply-chain
Resource Type:NotDefined

GitHub Actions organization settings define the default GITHUB_TOKEN permissions granted to every workflow run.

The evaluation determines whether the organization default is read-only, so that workflows have to opt in to write access through an explicit permissions block.

Prowler logoProwlerprowler-provider-github

Risk

A write-capable default GITHUB_TOKEN is available to every workflow in the organization, so any compromised step or dependency inherits it, leading to:

  • Code integrity loss from pushed commits, moved tags, or altered releases
  • Supply chain compromise when the token publishes packages or artifacts
  • Weakened review controls when the token acts on pull requests and issues

Run this check with Prowler

Run in Prowler Cloud
Run
prowler github --checks organization_default_workflow_permissions_read_only

Recommendation

Set the organization default GITHUB_TOKEN permissions to read-only and grant write scopes per workflow with an explicit permissions block, following least privilege.

Also prevent Actions from approving pull requests, and prefer short-lived GitHub App tokens over broad credentials when a workflow genuinely needs write access.

Remediation

CLI

gh api --method PUT /orgs/<organization>/actions/permissions/workflow -f default_workflow_permissions=read

Other

1Sign in to GitHub as an organization owner
2Go to your organization > Settings
3In the left sidebar, click Actions > General
4Under Workflow permissions, select Read repository contents and packages permissions
5Click Save

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportGithub
from prowler.providers.github.services.organization.organization_client import (
    organization_client,
)


class organization_default_workflow_permissions_read_only(Check):
    """Check if the default GITHUB_TOKEN permissions granted to workflows are read-only.

    This class verifies whether each organization grants workflows a read-only GITHUB_TOKEN
    by default, instead of a token with write access to the repository contents.
    """

    def execute(self) -> List[CheckReportGithub]:
        """Execute the Github Organization Default Workflow Permissions Read Only check.

        Iterates over all organizations and checks the default GITHUB_TOKEN permissions
        granted to GitHub Actions workflows.

        Returns:
            List[CheckReportGithub]: A list of reports for each organization
        """
        findings = []
        for org in organization_client.organizations.values():
            if org.default_workflow_permissions is not None:
                report = CheckReportGithub(metadata=self.metadata(), resource=org)
                report.status = "FAIL"
                report.status_extended = f"Organization {org.name} grants workflows a default GITHUB_TOKEN with {org.default_workflow_permissions} permissions."

                if org.default_workflow_permissions == "read":
                    report.status = "PASS"
                    report.status_extended = f"Organization {org.name} grants workflows a read-only default GITHUB_TOKEN."

                findings.append(report)

        return findings

References