ci: add GitHub token permissions for workflows#17781
ci: add GitHub token permissions for workflows#17781TravisEz13 merged 1 commit intoPowerShell:masterfrom
Conversation
|
This pull request has been automatically marked as Review Needed because it has been there has not been any activity for 7 days. |
|
@varunsh-coder Can you rebase your branch? |
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
Signed-off-by: Varun Sharma <varunsh@stepsecurity.io>
04ad77f to
038b94a
Compare
|
This PR has Quantification details
Why proper sizing of changes matters
Optimal pull request sizes drive a better predictable PR flow as they strike a
What can I do to optimize my changes
How to interpret the change counts in git diff output
Was this comment helpful? 👍 :ok_hand: :thumbsdown: (Email) |
Done |
|
/azp run PowerShell-CI-windows |
|
Azure Pipelines successfully started running 1 pipeline(s). |
|
/remind me tomorrow |
|
@TravisEz13 set a reminder for 8/5/2022 |
|
@varunsh-coder Thanks for your contribution. |
|
🎉 Handy links: |
PR Summary
This PR adds minimum token permissions for the GITHUB_TOKEN in GitHub Actions workflows using https://github.com/step-security/secure-workflows.
PR Context
GitHub recommends defining minimum GITHUB_TOKEN permissions for securing GitHub Actions workflows
This project is part of the top 100 critical projects as per OpenSSF (https://github.com/ossf/wg-securing-critical-projects), so fixing the token permissions to improve security.
Before the change:
GITHUB_TOKENhaswritepermissions for multiple scopes, e.g.https://github.com/PowerShell/PowerShell/runs/7530874225?check_suite_focus=true#step:1:19
After the change:
GITHUB_TOKENwill have minimum permissions needed for the jobs.Signed-off-by: Varun Sharma varunsh@stepsecurity.io
PR Checklist
.h,.cpp,.cs,.ps1and.psm1files have the correct copyright headerWIP:or[ WIP ]to the beginning of the title (theWIPbot will keep its status check atPendingwhile the prefix is present) and remove the prefix when the PR is ready.(which runs in a different PS Host).