This is an automated email from the ASF dual-hosted git repository.
alexstocks pushed a commit to branch 3.0
in repository https://gitbox.apache.org/repos/asf/dubbo-go.git
The following commit(s) were added to refs/heads/3.0 by this push:
new 65d3f387b Set permissions for GitHub actions (#1817)
65d3f387b is described below
commit 65d3f387bb0c5d82e50f8f46aa2e335662d6af5c
Author: nathannaveen <[email protected]>
AuthorDate: Thu Apr 14 07:07:08 2022 -0400
Set permissions for GitHub actions (#1817)
- Included permissions for the action.
https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions
https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
https://docs.github.com/en/actions/using-jobs/assigning-permissions-to-jobs
[Keeping your GitHub Actions and workflows secure Part 1: Preventing pwn
requests](https://securitylab.github.com/research/github-actions-preventing-pwn-requests/)
Restrict the GitHub token permissions only to the required ones; this way,
even if the attackers will succeed in compromising your workflow, they won’t be
able to do much.
Signed-off-by: nathannaveen <[email protected]>
---
.github/workflows/codeql-analysis.yml | 7 +++++++
.github/workflows/github-actions.yml | 3 +++
.github/workflows/golangci-lint.yml | 6 ++++++
3 files changed, 16 insertions(+)
diff --git a/.github/workflows/codeql-analysis.yml
b/.github/workflows/codeql-analysis.yml
index e8b926b2e..87ce23803 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -9,8 +9,15 @@ on:
schedule:
- cron: '0 4 * * 5'
+permissions:
+ contents: read
+
jobs:
analyse:
+ permissions:
+ actions: read # for github/codeql-action/init to get workflow details
+ contents: read # for actions/checkout to fetch code
+ security-events: write # for github/codeql-action/autobuild to send a
status report
name: Analyse
runs-on: ubuntu-latest
diff --git a/.github/workflows/github-actions.yml
b/.github/workflows/github-actions.yml
index b16760682..b93c944a8 100644
--- a/.github/workflows/github-actions.yml
+++ b/.github/workflows/github-actions.yml
@@ -6,6 +6,9 @@ on:
pull_request:
branches: "*"
+permissions:
+ contents: read
+
jobs:
build:
name: ${{ matrix.os }} - Go ${{ matrix.go_version }}
diff --git a/.github/workflows/golangci-lint.yml
b/.github/workflows/golangci-lint.yml
index 477720809..55ba6ae04 100644
--- a/.github/workflows/golangci-lint.yml
+++ b/.github/workflows/golangci-lint.yml
@@ -5,8 +5,14 @@ on:
pull_request:
branches: "*"
+permissions:
+ contents: read
+
jobs:
golangci:
+ permissions:
+ contents: read # for actions/checkout to fetch code
+ pull-requests: read # for golangci/golangci-lint-action to fetch pull
requests
name: lint
runs-on: ubuntu-latest
strategy:
