Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore: Set permissions for GitHub actions #343

Merged
merged 1 commit into from
Jul 27, 2022

Conversation

neilnaveen
Copy link
Contributor

Restrict the GitHub token permissions only to the required ones; this way, even if the attackers will succeed in compromising your workflow, they won’t be able to do much.

https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions

https://docs.github.com/en/actions/using-jobs/assigning-permissions-to-jobs

Keeping your GitHub Actions and workflows secure Part 1: Preventing pwn requests

Signed-off-by: neilnaveen [email protected]

 Restrict the GitHub token permissions only to the required ones; this way, even if the attackers will succeed in compromising your workflow, they won’t be able to do much.

- Included permissions for the action. https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions

https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions

https://docs.github.com/en/actions/using-jobs/assigning-permissions-to-jobs

[Keeping your GitHub Actions and workflows secure Part 1: Preventing pwn requests](https://securitylab.github.com/research/github-actions-preventing-pwn-requests/)

Signed-off-by: neilnaveen <[email protected]>
@eregon
Copy link
Member

eregon commented May 26, 2022

I don't see the point, to attack one would need permissions to create a release, if an attacker has that all bets are off anyway.

@eregon eregon closed this May 26, 2022
@eregon
Copy link
Member

eregon commented Jul 27, 2022

Upon reading more about this, I think it is useful (actions/checkout#485 (comment)), I'll merge this, thanks for the PR.
It is unfortunate that none of the links above really explains the issues/threats clearly.

@eregon eregon reopened this Jul 27, 2022
@eregon eregon merged commit 3325fe2 into ruby:master Jul 27, 2022
@eregon
Copy link
Member

eregon commented Jul 29, 2022

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

Successfully merging this pull request may close these issues.

2 participants