Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

security: add permissions block to workflows #1575

Merged
merged 6 commits into from
Mar 12, 2024
Merged

security: add permissions block to workflows #1575

Show file tree
Hide file tree
Changes from 4 commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
2929acf
security: add permissions block to workflows
reakaleek Feb 17, 2024
723511a
Merge branch 'main' into gh-oblt/add-permission-block-to-workflows
reakaleek Mar 11, 2024
c6dcb71
Update .github/workflows/labeler.yml
reakaleek Mar 11, 2024
41be0b6
security: add permissions block to workflows
reakaleek Mar 11, 2024
a588671
Update .github/workflows/snapshoty.yml
reakaleek Mar 11, 2024
f6c7707
Merge branch 'main' into gh-oblt/add-permission-block-to-workflows
dmathieu Mar 12, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions .github/workflows/addToAPMProject.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,9 @@ on:
issues:
types:
- opened
permissions:
contents: read

jobs:
add_to_project:
runs-on: ubuntu-latest
Expand Down
4 changes: 4 additions & 0 deletions .github/workflows/labeler.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,10 @@ on:
pull_request_target:
types: [opened]

permissions:
contents: read
reakaleek marked this conversation as resolved.
Show resolved Hide resolved
reakaleek marked this conversation as resolved.
Show resolved Hide resolved
issues: write

jobs:
triage:
runs-on: ubuntu-latest
Expand Down
4 changes: 4 additions & 0 deletions .github/workflows/snapshoty.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,10 @@ on:
- '*.asciidoc'
- 'docs/**'

permissions:
contents: read
actions: read
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

what's the reason for actions:read? I don't recall we needed it

Copy link
Member Author

@reakaleek reakaleek Mar 11, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I re-ran the gh-oblt script on this repo, and for some reason, this was added.
I don't know why it was missing since the workflow doesn't have a top-level permissions block.

I need to dig into this.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

But yes, looking at the snapshoty-simple action, I also don't see a reason for it.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
actions: read


jobs:
upload:
runs-on: ubuntu-latest
Expand Down