Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

ci: add minimum GitHub token permissions for workflows #1792

Merged
merged 1 commit into from Oct 3, 2022
Merged

ci: add minimum GitHub token permissions for workflows #1792

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
6 changes: 6 additions & 0 deletions .github/workflows/labeler.yml
View file
Open in desktop
Expand Up @@ -2,8 +2,14 @@ name: "Pull Request Labeler"
on:
- pull_request_target

permissions:
contents: read

jobs:
triage:
permissions:
contents: read # for actions/labeler to determine modified files
pull-requests: write # for actions/labeler to add labels to PRs
runs-on: ubuntu-latest
steps:
- uses: actions/labeler@v4
Expand Down
5 changes: 5 additions & 0 deletions .github/workflows/size-labeler.yml
View file
Open in desktop
Expand Up @@ -4,8 +4,13 @@ name: size-labeler

on: [pull_request_target]

permissions:
contents: read

jobs:
size-labeler:
permissions:
pull-requests: write # for codelytv/pr-size-labeler to add labels & comment on PRs
runs-on: ubuntu-latest
name: Label the PR size
steps:
Expand Down
6 changes: 6 additions & 0 deletions .github/workflows/stale.yml
View file
Open in desktop
Expand Up @@ -4,9 +4,15 @@ on:
schedule:
- cron: "0 0 * * *"

permissions:
contents: read

jobs:
stale:

permissions:
issues: write # for actions/stale to close stale issues
pull-requests: write # for actions/stale to close stale PRs
runs-on: ubuntu-latest

steps:
Expand Down
6 changes: 6 additions & 0 deletions .github/workflows/test.yml
View file
Open in desktop
Expand Up @@ -7,9 +7,15 @@ on:
env:
GO111MODULE: on

permissions:
contents: read

jobs:

golangci-lint:
permissions:
contents: read # for actions/checkout to fetch code
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This seems a little redundant to set the per-job permissions the same as the overall setting above. Are these changes generated from the security tool? If so, I suppose no harm in being a little more verbose.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi @stmcginnis, are you asking why contents: read is repeated at workflow level and job level?

The golangci-lint job needs two permissions. If contents: read is not specified at the job level, it will not be granted to the job. GitHub permission model works in a way that if no permissions are specified, the top level ones will apply. But if they are specified at the job level, then the specific ones will apply. So if only pull-requests: read is specified at job level, only that will be granted.

Since this is a public repo, that should also work. The tool that generates these fixes does not distinguish between a public or a private repo...so it ends up being a bit verbose for public repos...

pull-requests: read # for golangci/golangci-lint-action to fetch pull requests
runs-on: ubuntu-latest
steps:

Expand Down