chore: Set permissions for GitHub actions (#2555)

* chore: Set permissions for GitHub actions

 Restrict the GitHub token permissions only to the required ones; this way, even if the attackers will succeed in compromising your workflow, they won’t be able to do much.

- Included permissions for the action. https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions

https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions

https://docs.github.com/en/actions/using-jobs/assigning-permissions-to-jobs

[Keeping your GitHub Actions and workflows secure Part 1: Preventing pwn requests](https://securitylab.github.com/research/github-actions-preventing-pwn-requests/)

Signed-off-by: naveensrinivasan <172697+naveensrinivasan@users.noreply.github.com>

* Update docs-production-deploy.yml

* added `packages: write` permissions

this is apparently needed by GH so this repository can push new images.

Co-authored-by: Georg Lauterbach <44545919+georglauterbach@users.noreply.github.com>
Co-authored-by: Casper <casperklein@users.noreply.github.com>
This commit is contained in:
Naveen 2022-05-11 02:51:15 -05:00 committed by GitHub
parent 28dfb1bd00
commit 13a194466b
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
7 changed files with 26 additions and 0 deletions

View File

@ -14,6 +14,10 @@ on:
tags:
- '*.*.*'
permissions:
contents: read
packages: write
jobs:
build-and-test-image:
runs-on: ubuntu-20.04

View File

@ -17,6 +17,9 @@ concurrency:
# `pull_request` workflow is unreliable alone: Non-collaborator contributions lack access to secrets for security reasons.
# A separate workflow (docs-preview-deploy.yml) handles the deploy after the potentially untrusted code is first run in this workflow.
# See: https://securitylab.github.com/research/github-actions-preventing-pwn-requests/
permissions:
contents: read
jobs:
prepare-preview:
name: 'Build Preview'

View File

@ -23,6 +23,8 @@ env:
jobs:
deploy:
permissions:
contents: write
name: 'Deploy Docs'
runs-on: ubuntu-20.04
steps:
@ -68,6 +70,8 @@ jobs:
user_email: ${{ env.GIT_EMAIL }}
add-version-to-docs:
permissions:
contents: write
name: 'Update `versions.json` if necessary'
runs-on: ubuntu-20.04
if: startsWith(github.ref, 'refs/tags/')

View File

@ -4,8 +4,14 @@ on:
schedule:
- cron: "0 1 * * *"
permissions:
contents: read
jobs:
stale:
permissions:
issues: write
pull-requests: write
runs-on: ubuntu-20.04
steps:
- name: Close stale issues

View File

@ -7,6 +7,9 @@ on:
branches:
- master
permissions:
contents: read
jobs:
lint:
runs-on: ubuntu-20.04

View File

@ -4,6 +4,9 @@ on:
schedule:
- cron: "0 0 * * 5"
permissions:
contents: read
jobs:
publish:
runs-on: ubuntu-20.04

View File

@ -11,6 +11,9 @@ on:
- 'Dockerfile'
- 'setup.sh'
permissions:
contents: read
jobs:
build-and-test:
runs-on: ubuntu-20.04