From 419abe7200db363376b440873ff5cb07dfbae325 Mon Sep 17 00:00:00 2001
From: Eric Kerfoot <17726042+ericspod@users.noreply.github.com>
Date: Fri, 4 Sep 2026 20:36:07 +0100
Subject: [PATCH 1/3] Actions Security

Signed-off-by: Eric Kerfoot <17726042+ericspod@users.noreply.github.com>
---
 .github/workflows/blossom-ci.yml          | 9 ++-------
 .github/workflows/build_docs.yml          | 3 +++
 .github/workflows/chatops.yml             | 3 +++
 .github/workflows/cicd_tests.yml          | 3 +++
 .github/workflows/conda.yml               | 3 +++
 .github/workflows/cron-ngc-bundle.yml     | 3 +++
 .github/workflows/cron.yml                | 3 +++
 .github/workflows/docker.yml              | 3 +++
 .github/workflows/integration.yml         | 3 +++
 .github/workflows/pythonapp-gpu.yml       | 3 +++
 .github/workflows/pythonapp-hyena-gpu.yml | 3 +++
 .github/workflows/release.yml             | 3 +++
 .github/workflows/setupapp.yml            | 3 +++
 13 files changed, 38 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/blossom-ci.yml b/.github/workflows/blossom-ci.yml
index a564e2e27f0..c2de2dc15b5 100644
--- a/.github/workflows/blossom-ci.yml
+++ b/.github/workflows/blossom-ci.yml
@@ -13,13 +13,8 @@ on:
             required: false
 
 permissions:
-  actions: write
-  checks: write
-  contents: write
-  issues: write
-  pull-requests: write
-  repository-projects: write
-  statuses: write
+  contents: read
+  pull-request: read
 
 jobs:
   Authorization:
diff --git a/.github/workflows/build_docs.yml b/.github/workflows/build_docs.yml
index aeb2b8a2996..8d0d26d99af 100644
--- a/.github/workflows/build_docs.yml
+++ b/.github/workflows/build_docs.yml
@@ -12,6 +12,9 @@ on:
       - main
       - releasing/*
 
+permissions:
+  contents: read
+
 concurrency:
   # automatically cancel the previously triggered workflows when there's a newer version
   group: build-docs-${{ github.event.pull_request.number || github.ref }}
diff --git a/.github/workflows/chatops.yml b/.github/workflows/chatops.yml
index 41b7a2e158f..85336b7999c 100644
--- a/.github/workflows/chatops.yml
+++ b/.github/workflows/chatops.yml
@@ -1,6 +1,9 @@
 # triggering the workflows by commenting `/black` and `/integration-test`
 name: chatops
 
+permissions:
+  contents: read
+
 # currently dispatches /black command to project-monai/monai-code-formatter
 on:
   issue_comment:
diff --git a/.github/workflows/cicd_tests.yml b/.github/workflows/cicd_tests.yml
index e9b207951f6..cb65c7e3e21 100644
--- a/.github/workflows/cicd_tests.yml
+++ b/.github/workflows/cicd_tests.yml
@@ -21,6 +21,9 @@ on:
       - '**.rst'
       - 'docs/**'
 
+permissions:
+  contents: read
+
 concurrency:
   # automatically cancel the previously triggered workflows when there's a newer version
   group: cicd-tests-${{ github.event.pull_request.number || github.ref }}
diff --git a/.github/workflows/conda.yml b/.github/workflows/conda.yml
index 9cb72ab9a47..208a133d496 100644
--- a/.github/workflows/conda.yml
+++ b/.github/workflows/conda.yml
@@ -7,6 +7,9 @@ on:
   # Allows you to run this workflow manually from the Actions tab
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 concurrency:
   # automatically cancel the previously triggered workflows when there's a newer version
   group: conda-tests-${{ github.event.pull_request.number || github.ref }}
diff --git a/.github/workflows/cron-ngc-bundle.yml b/.github/workflows/cron-ngc-bundle.yml
index 650434eb37e..1421e1dfc12 100644
--- a/.github/workflows/cron-ngc-bundle.yml
+++ b/.github/workflows/cron-ngc-bundle.yml
@@ -7,6 +7,9 @@ on:
   # Allows you to run this workflow manually from the Actions tab
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 concurrency:
   # automatically cancel the previously triggered workflows when there's a newer version
   group: bundle-tests-${{ github.event.pull_request.number || github.ref }}
diff --git a/.github/workflows/cron.yml b/.github/workflows/cron.yml
index 9a01b346e5d..455d2b3cf5d 100644
--- a/.github/workflows/cron.yml
+++ b/.github/workflows/cron.yml
@@ -7,6 +7,9 @@ on:
   # Allows you to run this workflow manually from the Actions tab
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   cron-gpu:
     if: github.repository == 'Project-MONAI/MONAI'
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 921d8f5c89a..0813a20b3ee 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -13,6 +13,9 @@ on:
   # This is to trigger building/testing docker image from dev only.
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   versioning_dev:
     # compute versioning file from python setup.py
diff --git a/.github/workflows/integration.yml b/.github/workflows/integration.yml
index d3c1e473c72..81d4729c32a 100644
--- a/.github/workflows/integration.yml
+++ b/.github/workflows/integration.yml
@@ -5,6 +5,9 @@ on:
   repository_dispatch:
     type: [integration-test-command]
 
+permissions:
+  contents: read
+
 jobs:
   integration-auto3dseg:
     container:
diff --git a/.github/workflows/pythonapp-gpu.yml b/.github/workflows/pythonapp-gpu.yml
index 8378d2742ab..bc7c510713e 100644
--- a/.github/workflows/pythonapp-gpu.yml
+++ b/.github/workflows/pythonapp-gpu.yml
@@ -12,6 +12,9 @@ on:
   # Allows you to run this workflow manually from the Actions tab
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 concurrency:
   # automatically cancel the previously triggered workflows when there's a newer version
   group: build-gpu-${{ github.event.pull_request.number || github.ref }}
diff --git a/.github/workflows/pythonapp-hyena-gpu.yml b/.github/workflows/pythonapp-hyena-gpu.yml
index b080942bf3c..f30d8c8ba02 100644
--- a/.github/workflows/pythonapp-hyena-gpu.yml
+++ b/.github/workflows/pythonapp-hyena-gpu.yml
@@ -22,6 +22,9 @@ name: hyena-gpu
 on:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 concurrency:
   group: hyena-gpu-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index d4c55e1f08b..2df2079c7d6 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -8,6 +8,9 @@ on:
     tags:
       - '*'
 
+permissions:
+  contents: read
+
 jobs:
   packaging:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/setupapp.yml b/.github/workflows/setupapp.yml
index d7bf1dc6dd0..cb1dda6823a 100644
--- a/.github/workflows/setupapp.yml
+++ b/.github/workflows/setupapp.yml
@@ -13,6 +13,9 @@ on:
     # Allows you to run this workflow manually from the Actions tab
     workflow_dispatch:
 
+permissions:
+  contents: read
+
 concurrency:
   # automatically cancel the previously triggered workflows when there's a newer version
   group: deploy-${{ github.event.pull_request.number || github.ref }}

From 08a4d0f1969a4e3825be9def52ec002940cc6378 Mon Sep 17 00:00:00 2001
From: Eric Kerfoot <17726042+ericspod@users.noreply.github.com>
Date: Fri, 4 Sep 2026 21:03:50 +0100
Subject: [PATCH 2/3] Update blossom action

Signed-off-by: Eric Kerfoot <17726042+ericspod@users.noreply.github.com>
---
 .github/workflows/blossom-ci.yml | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/blossom-ci.yml b/.github/workflows/blossom-ci.yml
index c2de2dc15b5..6b0c736ff4c 100644
--- a/.github/workflows/blossom-ci.yml
+++ b/.github/workflows/blossom-ci.yml
@@ -14,7 +14,8 @@ on:
 
 permissions:
   contents: read
-  pull-request: read
+  pull-requests: read
+  statuses: write
 
 jobs:
   Authorization:
@@ -49,7 +50,7 @@ jobs:
         uses: actions/checkout@v7
         with:
           repository: ${{ fromJson(needs.Authorization.outputs.args).repo }}
-          ref: ${{ fromJson(needs.Authorization.outputs.args).ref }}
+          ref: ${{ fromJson(needs.Authorization.outputs.args).sha }}
           lfs: 'true'
 
       # repo specific steps

From bebccdbd6df6d7a7f8d8745c6a2747edeea93cda Mon Sep 17 00:00:00 2001
From: Eric Kerfoot <17726042+ericspod@users.noreply.github.com>
Date: Fri, 4 Sep 2026 21:04:02 +0100
Subject: [PATCH 3/3] Update URL checking in utils

Signed-off-by: Eric Kerfoot <17726042+ericspod@users.noreply.github.com>
---
 monai/apps/utils.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/monai/apps/utils.py b/monai/apps/utils.py
index 57cc7b18a4a..b15b0c1969c 100644
--- a/monai/apps/utils.py
+++ b/monai/apps/utils.py
@@ -378,7 +378,7 @@ def get_filename_from_url(data_url: str) -> str:
             filename = re.findall('filename="?([^";]+)"?', content_disposition)
             if filename:
                 return str(filename[0])
-        if "drive.google.com" in data_url:
+        if urlparse(data_url).netloc == "drive.google.com":
             response = requests.get(data_url)
             if "text/html" in response.headers.get("Content-Type", ""):
                 soup = BeautifulSoup(response.text, "html.parser")