Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Set permissions for Github Workflows #738

Open
joycebrum opened this issue Aug 3, 2023 · 2 comments · May be fixed by #759
Open

Set permissions for Github Workflows #738

joycebrum opened this issue Aug 3, 2023 · 2 comments · May be fixed by #759

Comments

@joycebrum
Copy link

Hi, I work at Google together with the OpenSSF to help open source projects improve their supply chain security by using the OpenSSF Scorecard as a guide.

I would like to suggest a PR to change the top-level and run-level permissions for GitHub workflows to only grant write permissions at the run level.

This is necessary because, by default, GitHub grants write-all permissions to all workflows, which could be exploited by an attacker if a workflow is compromised. Limiting permissions is a simple and effective way to limit the impact of a compromised workflow.

Therefore, both the OpenSSF Scorecard and GitHub recommend using minimally scoped credentials.

Please let me know if you have any questions or concerns.
@joycebrum
Copy link
Author

If a PR is welcome let me know and I'll submit it ASAP

@diogoteles08
Copy link

Hi! I'm Diogo and I work along with Joyce in Google’s Open Source Security Team.

This issue has been idle for a while. Do you plan on considering this suggestion? Since the changes are actually very simple, I'll take the liberty to raise a PR with them and possibly ease your evaluation =)

Thanks!

@diogoteles08 diogoteles08 linked a pull request Oct 12, 2023 that will close this issue
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

ci: set minimal permissions to GitHub workflows diogoteles08/pyyaml
2 participants
@joycebrum @diogoteles08