You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@dubbo.apache.org by al...@apache.org on 2022/04/14 11:07:14 UTC
[dubbo-go] branch 3.0 updated: Set permissions for GitHub actions (#1817)
This is an automated email from the ASF dual-hosted git repository.
alexstocks pushed a commit to branch 3.0
in repository https://gitbox.apache.org/repos/asf/dubbo-go.git
The following commit(s) were added to refs/heads/3.0 by this push:
new 65d3f387b Set permissions for GitHub actions (#1817)
65d3f387b is described below
commit 65d3f387bb0c5d82e50f8f46aa2e335662d6af5c
Author: nathannaveen <42...@users.noreply.github.com>
AuthorDate: Thu Apr 14 07:07:08 2022 -0400
Set permissions for GitHub actions (#1817)
- Included permissions for the action. https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions
https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
https://docs.github.com/en/actions/using-jobs/assigning-permissions-to-jobs
[Keeping your GitHub Actions and workflows secure Part 1: Preventing pwn requests](https://securitylab.github.com/research/github-actions-preventing-pwn-requests/)
Restrict the GitHub token permissions only to the required ones; this way, even if the attackers will succeed in compromising your workflow, they won’t be able to do much.
Signed-off-by: nathannaveen <42...@users.noreply.github.com>
---
.github/workflows/codeql-analysis.yml | 7 +++++++
.github/workflows/github-actions.yml | 3 +++
.github/workflows/golangci-lint.yml | 6 ++++++
3 files changed, 16 insertions(+)
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index e8b926b2e..87ce23803 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -9,8 +9,15 @@ on:
schedule:
- cron: '0 4 * * 5'
+permissions:
+ contents: read
+
jobs:
analyse:
+ permissions:
+ actions: read # for github/codeql-action/init to get workflow details
+ contents: read # for actions/checkout to fetch code
+ security-events: write # for github/codeql-action/autobuild to send a status report
name: Analyse
runs-on: ubuntu-latest
diff --git a/.github/workflows/github-actions.yml b/.github/workflows/github-actions.yml
index b16760682..b93c944a8 100644
--- a/.github/workflows/github-actions.yml
+++ b/.github/workflows/github-actions.yml
@@ -6,6 +6,9 @@ on:
pull_request:
branches: "*"
+permissions:
+ contents: read
+
jobs:
build:
name: ${{ matrix.os }} - Go ${{ matrix.go_version }}
diff --git a/.github/workflows/golangci-lint.yml b/.github/workflows/golangci-lint.yml
index 477720809..55ba6ae04 100644
--- a/.github/workflows/golangci-lint.yml
+++ b/.github/workflows/golangci-lint.yml
@@ -5,8 +5,14 @@ on:
pull_request:
branches: "*"
+permissions:
+ contents: read
+
jobs:
golangci:
+ permissions:
+ contents: read # for actions/checkout to fetch code
+ pull-requests: read # for golangci/golangci-lint-action to fetch pull requests
name: lint
runs-on: ubuntu-latest
strategy: