Skip to content

Commit

Permalink
GitHub Workflows security hardening
Browse files Browse the repository at this point in the history
This commit adds explicit permissions section to workflows.

This is a security best practice because by default workflows run with extended set of permissions (except from on: pull_request from external forks).

By specifying any permission explicitly all others are set to none. By using the principle of least privilege the damage a compromised workflow can do (because of an injection or compromised third party tool or action) is restricted.

It is recommended to have most strict permissions on the top level and grant write permissions on job level case by case.

Refs #2810
  • Loading branch information
sashashura authored and joschi committed Aug 31, 2022
1 parent e8ad9df commit 92742f9
Showing 1 changed file with 2 additions and 0 deletions.
2 changes: 2 additions & 0 deletions .github/workflows/maven.yml
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,8 @@ on:
push:
branches:
- release/*
permissions:
contents: read
jobs:
build:
runs-on: ${{ matrix.os }}
Expand Down

0 comments on commit 92742f9

Please sign in to comment.