diff options
| author | Alex <93376818+sashashura@users.noreply.github.com> | 2022-09-02 11:01:41 +0300 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2022-09-02 11:01:41 +0300 |
| commit | 7152729110c5a6525e1dbbd3215430f3364830d6 (patch) | |
| tree | 34ffc71b054aeec09dc292e9de1989a96eea6454 | |
| parent | 0c32ff765c55eecd0d78336d5805421c4bc661de (diff) | |
GitHub Workflows security hardening (#21544)
This PR adds explicit [permissions section](https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions) to workflows. This is a security best practice because by default workflows run with [extended set of permissions](https://docs.github.com/en/actions/security-guides/automatic-token-authentication#permissions-for-the-github_token) (except from `on: pull_request` [from external forks](https://securitylab.github.com/research/github-actions-preventing-pwn-requests/)). By specifying any permission explicitly all others are set to none. By using the principle of least privilege the damage a compromised workflow can do (because of an [injection](https://securitylab.github.com/research/github-actions-untrusted-input/) or compromised third party tool or action) is restricted.
It is recommended to have [most strict permissions on the top level](https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions) and grant write permissions on [job level](https://docs.github.com/en/actions/using-jobs/assigning-permissions-to-jobs) case by case.
| -rw-r--r-- | .github/workflows/backport.yml | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/.github/workflows/backport.yml b/.github/workflows/backport.yml index 96551f2cd38..baf7a79a29a 100644 --- a/.github/workflows/backport.yml +++ b/.github/workflows/backport.yml @@ -3,8 +3,14 @@ on: issue_comment: types: [created] +permissions: + contents: read + jobs: backport: + permissions: + issues: write # for octokit.rest.issues.createComment in ./scripts/ci/actions/backport + pull-requests: write # for octokit.rest.pulls.create in ./scripts/ci/actions/backport if: github.event.issue.pull_request != '' && contains(github.event.comment.body, '/backport to') runs-on: ubuntu-20.04 steps: |