Why It Matters

SEC328 flags GitHub Actions workflows that combine explicit write-capable token permissions with a third-party action.

This is a compositional hardening rule: the risk comes from the combination, not from either ingredient alone. A third-party action with write-capable token scopes deserves more review than the same action under read-only permissions.

What Triggers

SEC328 applies to semantically valid GitHub Actions workflow YAML and triggers when:

• the workflow grants explicit write-capable permissions such as contents: write
• a job uses a third-party action
• and the action reference is still third-party even if it is pinned to a full SHA

Example that triggers:

permissions:
  contents: write
jobs:
  build:
    steps:
      - uses: docker/login-action@0123456789abcdef0123456789abcdef01234567

Example that stays clean:

permissions:
  contents: read
jobs:
  build:
    steps:
      - uses: docker/login-action@0123456789abcdef0123456789abcdef01234567

False Positives

This rule stays Preview because it is intentionally compositional. Some workflows really do need write-capable permissions and vetted third-party actions, but the combination is still important enough to review explicitly before it graduates to a stronger posture.

Remediation

Reduce permissions to the minimum required, replace the third-party action with a safer trusted alternative when possible, or isolate the write-capable step so the broader workflow does not hand write authority to unnecessary third-party logic.