You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@orc.apache.org by GitBox <gi...@apache.org> on 2022/04/25 22:08:40 UTC
[GitHub] [orc] naveensrinivasan opened a new pull request, #1096: chore: Set permissions for GitHub actions
naveensrinivasan opened a new pull request, #1096:
URL: https://github.com/apache/orc/pull/1096
Restrict the GitHub token permissions only to the required ones; this way, even if the attackers will succeed in compromising your workflow, they won’t be able to do much.
- Included permissions for the action. https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions
https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
https://docs.github.com/en/actions/using-jobs/assigning-permissions-to-jobs
[Keeping your GitHub Actions and workflows secure Part 1: Preventing pwn requests](https://securitylab.github.com/research/github-actions-preventing-pwn-requests/)
Signed-off-by: naveen <17...@users.noreply.github.com>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@orc.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [orc] dongjoon-hyun commented on pull request #1096: chore: Set permissions for GitHub actions
Posted by GitBox <gi...@apache.org>.
dongjoon-hyun commented on PR #1096:
URL: https://github.com/apache/orc/pull/1096#issuecomment-1110299862
What I asked is `without this patch`, @naveensrinivasan .
IIRC, I've never heard about that kind of vulnerability on Apache repos from ASF Infra team.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@orc.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [orc] dongjoon-hyun commented on pull request #1096: chore: Set permissions for GitHub actions
Posted by GitBox <gi...@apache.org>.
dongjoon-hyun commented on PR #1096:
URL: https://github.com/apache/orc/pull/1096#issuecomment-1110441584
What do you mean by the following? If there is no possibility of vulnerability, we don't need this PR by the definition. It's not up to anyone's decision.
> I will let you decide!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@orc.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [orc] naveensrinivasan commented on pull request #1096: chore: Set permissions for GitHub actions
Posted by GitBox <gi...@apache.org>.
naveensrinivasan commented on PR #1096:
URL: https://github.com/apache/orc/pull/1096#issuecomment-1110266757
> Gentle ping, @naveensrinivasan ~
With the restricted permissions, they won't be able to compromise. HTH
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@orc.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [orc] dongjoon-hyun commented on pull request #1096: chore: Set permissions for GitHub actions
Posted by GitBox <gi...@apache.org>.
dongjoon-hyun commented on PR #1096:
URL: https://github.com/apache/orc/pull/1096#issuecomment-1109386489
Gentle ping, @naveensrinivasan ~
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@orc.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [orc] naveensrinivasan closed pull request #1096: chore: Set permissions for GitHub actions
Posted by GitBox <gi...@apache.org>.
naveensrinivasan closed pull request #1096: chore: Set permissions for GitHub actions
URL: https://github.com/apache/orc/pull/1096
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@orc.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [orc] dongjoon-hyun commented on pull request #1096: chore: Set permissions for GitHub actions
Posted by GitBox <gi...@apache.org>.
dongjoon-hyun commented on PR #1096:
URL: https://github.com/apache/orc/pull/1096#issuecomment-1111661283
Thank you for closing, @naveensrinivasan .
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@orc.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [orc] naveensrinivasan commented on pull request #1096: chore: Set permissions for GitHub actions
Posted by GitBox <gi...@apache.org>.
naveensrinivasan commented on PR #1096:
URL: https://github.com/apache/orc/pull/1096#issuecomment-1110369244
> What I asked is `without this patch`, @naveensrinivasan .
> IIRC, I've never heard about that kind of vulnerability on Apache repos from ASF Infra team.
I will let you decide!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@orc.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org