Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

github: Minimize permissions granted to automated workflows / jobs #400

Merged
merged 1 commit into from
Nov 30, 2023

Conversation

jigpu
Copy link
Member

@jigpu jigpu commented Nov 29, 2023

Jobs that use the GITHUB_TOKEN to perform sensitive actions on behalf of a real user may be granted a range of permissions. Instead of granting blanket permissions to read and write "all" APIs, we should really limit the permissions what any individual workflow or job can do.

This commit sets the default permissions for each workflow to "contents: read", which allows jobs to only read from the repository. The one job that requires additional permission is our "tagged_release" job which additional requires write access.

Link: https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idpermissions
Link: #317

Jobs that use the GITHUB_TOKEN to perform sensitive actions on behalf of
a real user may be granted a range of permissions. Instead of granting
blanket permissions to read and write "all" APIs, we should really limit
the permissions what any individual workflow or job can do.

This commit sets the default permissions for each workflow to "contents:
read", which allows jobs to only read from the repository. The one job
that requires additional permission is our "tagged_release" job which
additional requires write access.

Link: https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idpermissions
Link: linuxwacom#317
Signed-off-by: Jason Gerecke <[email protected]>
@Pinglinux Pinglinux merged commit 8f49546 into linuxwacom:master Nov 30, 2023
12 checks passed
@Pinglinux
Copy link
Member

Merged. Thank you Jason!

@jigpu jigpu deleted the action-permissions branch February 13, 2024 23:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants