You are viewing a plain text version of this content. The canonical link for it is here.
Posted to github@beam.apache.org by "diogoteles08 (via GitHub)" <gi...@apache.org> on 2023/02/27 16:21:54 UTC
[GitHub] [beam] diogoteles08 opened a new issue, #25641: [Task]: Set minimum permissions on GitHub Workflows
diogoteles08 opened a new issue, #25641:
URL: https://github.com/apache/beam/issues/25641
### What needs to happen?
Hi!
I'd like to suggest the addition of top-level minimal permissions on your workflows, as it would harden your security agains supply-chain attacks.
I see that some of your workflows have well-defined job-level permissions (e.g. [assign_milestone.yml](https://github.com/apache/beam/blob/master/.github/workflows/assign_milestone.yml)), but others don't have them explicitly defined (e.g. some jobs on [build_wheels.yml](https://github.com/apache/beam/blob/master/.github/workflows/build_wheels.yml)), and the job's privileges would be determined by GitHub's defaults. If you set top-level minimal permissions on a workflow, they would be inherited by all jobs with unspecified permissions on that workflow, including newly created jobs.
Setting minimum permissions for workflows is recommended by [GitHub itself](https://docs.github.com/en/actions/security-guides/automatic-token-authentication) and also by other security tools, such as [Scorecards](https://github.com/ossf/scorecard) and [StepSecurity](https://github.com/step-security). I'd be happy to raise a PR with the changes if you agree.
#### Context
I'm Diogo and I work on Google's Open Source Security Team([GOSST](https://github.com/diogoteles08#about-gosst-ghost)) suggesting and implementing security changes on critical open source projects.
### Issue Priority
Priority: 3 (nice-to-have improvement)
### Issue Components
- [ ] Component: Python SDK
- [ ] Component: Java SDK
- [ ] Component: Go SDK
- [ ] Component: Typescript SDK
- [ ] Component: IO connector
- [ ] Component: Beam examples
- [ ] Component: Beam playground
- [ ] Component: Beam katas
- [ ] Component: Website
- [ ] Component: Spark Runner
- [ ] Component: Flink Runner
- [ ] Component: Samza Runner
- [ ] Component: Twister2 Runner
- [ ] Component: Hazelcast Jet Runner
- [ ] Component: Google Cloud Dataflow Runner
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@beam.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [beam] diogoteles08 commented on issue #25641: [Task]: Set minimum permissions on GitHub Workflows
Posted by "diogoteles08 (via GitHub)" <gi...@apache.org>.
diogoteles08 commented on issue #25641:
URL: https://github.com/apache/beam/issues/25641#issuecomment-1451954326
I just read your [.github/ACTIONS.md](https://github.com/apache/beam/blob/master/.github/ACTIONS.md), in which AFAIU you already say that all of the action on the repo should have `permissions: read-all` on their top-level. So I apologize if in this issue I'm bringing informations that you were already aware of.
In any case, some of your actions are currently not following those permission requirements, so I'll take the liberty to assign myself to this task and raise a PR with the necessary changes.
.take-issue
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@beam.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [beam] diogoteles08 closed issue #25641: [Task]: Set minimum permissions on GitHub Workflows
Posted by "diogoteles08 (via GitHub)" <gi...@apache.org>.
diogoteles08 closed issue #25641: [Task]: Set minimum permissions on GitHub Workflows
URL: https://github.com/apache/beam/issues/25641
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@beam.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org