Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore: Set permissions for GitHub actions #901

Merged
merged 4 commits into from
Dec 5, 2022
Merged

chore: Set permissions for GitHub actions #901

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
1ff214c
chore: Set permissions for GitHub actions
neilnaveen Jun 1, 2022
78509ed
Merge branch 'main' into Pinned-Dependencies-GitHub
bhrutledge Dec 5, 2022
b5c4dd4
Update .github/workflows/codeql-analysis.yml
bhrutledge Dec 5, 2022
10790cc
Merge branch 'main' into Pinned-Dependencies-GitHub
bhrutledge Dec 5, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions .github/workflows/codeql-analysis.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,8 +14,15 @@ on:
schedule:
- cron: '0 13 * * 3'

permissions:
contents: read

Comment on lines +23 to +25
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The default permissions for our workflows is already 'read', so I don't believe this is necessary.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@di this also sets all the other (non-content) scopes to null restricting them even further. It's one of the latest best practices security-wise.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It looks like this isn't widely-adopted in the pypa org; only pipenv seems to do it for their CI workflow. @neilnaveen out of curiosity, why did you choose this to add this to Twine?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@bhrutledge I saw it being adopted by attrs and I know that Tidelift is starting to push for openSSF, so I foresee it appearing on our radars more often over time. I'm slowly adopting this too.

jobs:
analyze:
permissions:
actions: read # for github/codeql-action/init to get workflow details
contents: read # for actions/checkout to fetch code
security-events: write # for github/codeql-action/autobuild to send a status report
bhrutledge marked this conversation as resolved.
Show resolved Hide resolved
name: Analyze
runs-on: ubuntu-latest

Expand Down
3 changes: 3 additions & 0 deletions .github/workflows/main.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,9 @@ env:
MIN_PYTHON_VERSION: "3.7"
DEFAULT_PYTHON_VERSION: "3.9"

permissions:
contents: read

Comment on lines +21 to +23
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ditto here.

jobs:
lint:
runs-on: ubuntu-latest
Expand Down