GitHub Workflows security hardening #4587

sashashura · 2022-09-25T21:05:39Z

This PR adds explicit permissions section to workflows. This is a security best practice because by default workflows run with extended set of permissions (except from on: pull_request from external forks). By specifying any permission explicitly all others are set to none. By using the principle of least privilege the damage a compromised workflow can do (because of an injection or compromised third party tool or action) is restricted.
It is recommended to have most strict permissions on the top level and grant write permissions on job level case by case.

github-actions · 2022-09-25T21:31:07Z

Gradle Check (Jenkins) Run Completed with:

RESULT: SUCCESS ✅
URL: https://build.ci.opensearch.org/job/gradle-check/3377/
CommitID: 084bdbb

codecov-commenter · 2022-09-25T21:32:23Z

Codecov Report

Merging #4587 (0734d2b) into main (4616dfa) will increase coverage by 0.00%.
The diff coverage is n/a.

@@            Coverage Diff            @@
##               main    #4587   +/-   ##
=========================================
  Coverage     70.98%   70.98%           
+ Complexity    58185    58169   -16     
=========================================
  Files          4711     4711           
  Lines        277573   277573           
  Branches      40180    40180           
=========================================
+ Hits         197031   197040    +9     
- Misses        64386    64392    +6     
+ Partials      16156    16141   -15

Impacted Files	Coverage Δ
...n/indices/forcemerge/ForceMergeRequestBuilder.java	`0.00% <0.00%> (-75.00%)`	⬇️
.../indices/forcemerge/TransportForceMergeAction.java	`25.00% <0.00%> (-75.00%)`	⬇️
...ava/org/opensearch/action/NoSuchNodeException.java	`0.00% <0.00%> (-50.00%)`	⬇️
.../admin/cluster/reroute/ClusterRerouteResponse.java	`60.00% <0.00%> (-40.00%)`	⬇️
...luster/routing/allocation/RoutingExplanations.java	`62.06% <0.00%> (-37.94%)`	⬇️
...arch/search/aggregations/pipeline/LinearModel.java	`23.07% <0.00%> (-34.62%)`	⬇️
...nsearch/index/shard/IndexShardClosedException.java	`66.66% <0.00%> (-33.34%)`	⬇️
...on/admin/indices/forcemerge/ForceMergeRequest.java	`50.00% <0.00%> (-31.58%)`	⬇️
...cluster/routing/allocation/RerouteExplanation.java	`70.00% <0.00%> (-30.00%)`	⬇️
.../java/org/opensearch/index/reindex/RemoteInfo.java	`50.45% <0.00%> (-29.36%)`	⬇️
... and 453 more

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

github-actions · 2022-09-26T07:45:03Z

Gradle Check (Jenkins) Run Completed with:

RESULT: SUCCESS ✅
URL: https://build.ci.opensearch.org/job/gradle-check/3388/
CommitID: ba00983

github-actions · 2022-09-26T07:49:02Z

Gradle Check (Jenkins) Run Completed with:

RESULT: FAILURE ❌
URL: https://build.ci.opensearch.org/job/gradle-check/3389/
CommitID: 8478ad4

github-actions · 2022-09-27T19:40:12Z

Gradle Check (Jenkins) Run Completed with:

RESULT: SUCCESS ✅
URL: https://build.ci.opensearch.org/job/gradle-check/3495/
CommitID: 8478ad4

VachaShah · 2022-09-27T22:34:52Z

.github/workflows/version.yml

 jobs:
  build:
+    permissions:
+      contents: write # to create branch (peter-evans/create-pull-request)


This might not need the permissions since the token used here is from the Github App Token from an app and not the default Github token.

Sorry for missing that. You are right. Fixed.

github-actions · 2022-09-27T23:27:43Z

Gradle Check (Jenkins) Run Completed with:

RESULT: SUCCESS ✅
URL: https://build.ci.opensearch.org/job/gradle-check/3504/
CommitID: 0aab28c

github-actions · 2022-10-05T10:21:30Z

Gradle Check (Jenkins) Run Completed with:

RESULT: SUCCESS ✅
URL: https://build.ci.opensearch.org/job/gradle-check/3841/
CommitID: 2a563a1

dblock · 2022-10-05T14:32:41Z

Please amend commits to fix DCO with -s

dblock · 2022-10-05T14:33:23Z

CHANGELOG.md

@@ -6,6 +6,7 @@ Inspired from [Keep a Changelog](https://keepachangelog.com/en/1.0.0/)

 ### Added

+- GitHub Workflows token permission hardening ([#4587](https://github.com/opensearch-project/OpenSearch/pull/4587))


Nit: maybe we can turn all these changelog lines into something that was actioned, e.g. Hardened token permissions in GitHub workflow?

Signed-off-by: sashashura <[email protected]>

github-actions · 2022-10-12T10:01:30Z

Gradle Check (Jenkins) Run Completed with:

RESULT: FAILURE ❌
URL: https://build.ci.opensearch.org/job/gradle-check/4486/
CommitID: dffe76a

github-actions · 2022-10-12T10:02:15Z

Gradle Check (Jenkins) Run Completed with:

RESULT: FAILURE ❌
URL: https://build.ci.opensearch.org/job/gradle-check/4487/
CommitID: 0805cda

github-actions · 2022-10-12T10:17:37Z

Gradle Check (Jenkins) Run Completed with:

RESULT: FAILURE ❌
URL: https://build.ci.opensearch.org/job/gradle-check/4489/
CommitID: d89482d

github-actions · 2022-10-12T10:21:11Z

Gradle Check (Jenkins) Run Completed with:

RESULT: FAILURE ❌
URL: https://build.ci.opensearch.org/job/gradle-check/4490/
CommitID: f4149ac

sashashura · 2022-10-12T10:23:43Z

I don't think the gradle check failure is related to the changes, but let me know.

github-actions · 2022-10-12T10:37:53Z

Gradle Check (Jenkins) Run Completed with:

RESULT: FAILURE ❌
URL: https://build.ci.opensearch.org/job/gradle-check/4488/
CommitID: 34a40e0

github-actions · 2022-11-30T22:51:51Z

Gradle Check (Jenkins) Run Completed with:

RESULT: UNSTABLE ❕
TEST FAILURES:

      1 org.opensearch.index.ShardIndexingPressureConcurrentExecutionTests.testReplicaThreadedUpdateToShardLimitsAndRejections
      1 org.opensearch.http.SearchRestCancellationIT.testAutomaticCancellationDuringFetchPhase

URL: https://build.ci.opensearch.org/job/gradle-check/7463/
CommitID: 0734d2b
Please review all flaky tests that succeeded after retry and create an issue if one does not already exist to track the flaky failure.

sashashura · 2022-11-30T23:10:28Z

@reta Could you please review it?

opensearch-trigger-bot · 2023-01-30T18:48:01Z

The backport to 2.x failed:

The process '/usr/bin/git' failed with exit code 128

To backport manually, run these commands in your terminal:

# Fetch latest updates from GitHub
git fetch
# Create a new working tree
git worktree add ../.worktrees/backport-2.x 2.x
# Navigate to the new working tree
pushd ../.worktrees/backport-2.x
# Create a new branch
git switch --create backport/backport-4587-to-2.x
# Cherry-pick the merged commit of this pull request and resolve the conflicts
git cherry-pick -x --mainline 1 d266a732aea4cf87781acf93e92c56ad3f1d0913
# Push it to GitHub
git push --set-upstream origin backport/backport-4587-to-2.x
# Go back to the original working tree
popd
# Delete the working tree
git worktree remove ../.worktrees/backport-2.x

Then, create a pull request where the base branch is 2.x and the compare/head branch is backport/backport-4587-to-2.x.

Signed-off-by: sashashura <[email protected]> Signed-off-by: sashashura <[email protected]> (cherry picked from commit d266a73)

mch2 · 2023-01-30T19:55:28Z

Manual backport #6097

Signed-off-by: sashashura <[email protected]> Signed-off-by: sashashura <[email protected]> (cherry picked from commit d266a73) Signed-off-by: Marc Handalian <[email protected]>

(cherry picked from commit d266a73) Signed-off-by: sashashura <[email protected]> Signed-off-by: Marc Handalian <[email protected]> Co-authored-by: Alex <[email protected]>

sashashura requested review from a team and reta as code owners September 25, 2022 21:05

dreamer-89 approved these changes Sep 26, 2022

View reviewed changes

sashashura force-pushed the patch-1 branch from ba00983 to 8478ad4 Compare September 26, 2022 07:21

dblock approved these changes Sep 27, 2022

View reviewed changes

saratvemulapalli approved these changes Sep 27, 2022

View reviewed changes

saratvemulapalli added backport 2.x Backport to 2.x branch v3.0.0 Issues and PRs related to version 3.0.0 CI CI related labels Sep 27, 2022

VachaShah reviewed Sep 27, 2022

View reviewed changes

dblock approved these changes Sep 29, 2022

View reviewed changes

dblock reviewed Oct 5, 2022

View reviewed changes

sashashura force-pushed the patch-1 branch 3 times, most recently from 34a40e0 to d89482d Compare October 12, 2022 09:51

build: harden worfklows permissions

f4149ac

Signed-off-by: sashashura <[email protected]>

sashashura force-pushed the patch-1 branch from d89482d to f4149ac Compare October 12, 2022 10:01

Merge branch 'main' into patch-1

0734d2b

reta approved these changes Dec 1, 2022

View reviewed changes

reta merged commit d266a73 into opensearch-project:main Dec 1, 2022

This was referenced Dec 1, 2022

[BUG] org.opensearch.http.SearchRestCancellationIT.testAutomaticCancellationDuringFetchPhase flaky #5426

Closed

[BUG] Fix flaky test org.opensearch.index.ShardIndexingPressureConcurrentExecutionTests.testReplicaThreadedUpdateToShardLimitsAndRejections #4212

Closed

mch2 added backport 2.x Backport to 2.x branch and removed backport 2.x Backport to 2.x branch labels Jan 30, 2023

mch2 pushed a commit to mch2/OpenSearch that referenced this pull request Jan 30, 2023

build: harden worfklows permissions (opensearch-project#4587)

b6c26ef

Signed-off-by: sashashura <[email protected]> Signed-off-by: sashashura <[email protected]> (cherry picked from commit d266a73)

mch2 mentioned this pull request Jan 30, 2023

[Backport 2.x] build: harden worfklows permissions (#4587) #6097

Merged

6 tasks

mch2 mentioned this pull request Jan 30, 2023

Remove CI related changelog entry. #6098

Merged

6 tasks

dblock mentioned this pull request May 1, 2023

Partially resolved issue #4687 by changing the improper status code for concurrent snapshot executions #5855

Closed

6 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

GitHub Workflows security hardening #4587

GitHub Workflows security hardening #4587

sashashura commented Sep 25, 2022

github-actions bot commented Sep 25, 2022

codecov-commenter commented Sep 25, 2022 •

edited

Loading

github-actions bot commented Sep 26, 2022

github-actions bot commented Sep 26, 2022

github-actions bot commented Sep 27, 2022

VachaShah Sep 27, 2022 •

edited

Loading

sashashura Sep 27, 2022

github-actions bot commented Sep 27, 2022

github-actions bot commented Oct 5, 2022

dblock commented Oct 5, 2022

dblock Oct 5, 2022

sashashura Oct 12, 2022

github-actions bot commented Oct 12, 2022

github-actions bot commented Oct 12, 2022

github-actions bot commented Oct 12, 2022

github-actions bot commented Oct 12, 2022

sashashura commented Oct 12, 2022

github-actions bot commented Oct 12, 2022

github-actions bot commented Nov 30, 2022

sashashura commented Nov 30, 2022

opensearch-trigger-bot bot commented Jan 30, 2023

mch2 commented Jan 30, 2023

		@@ -6,6 +6,7 @@ Inspired from [Keep a Changelog](https://keepachangelog.com/en/1.0.0/)

		### Added

		- GitHub Workflows token permission hardening ([#4587](https://github.com/opensearch-project/OpenSearch/pull/4587))

GitHub Workflows security hardening #4587

GitHub Workflows security hardening #4587

Conversation

sashashura commented Sep 25, 2022

github-actions bot commented Sep 25, 2022

Gradle Check (Jenkins) Run Completed with:

codecov-commenter commented Sep 25, 2022 • edited Loading

Codecov Report

github-actions bot commented Sep 26, 2022

Gradle Check (Jenkins) Run Completed with:

github-actions bot commented Sep 26, 2022

Gradle Check (Jenkins) Run Completed with:

github-actions bot commented Sep 27, 2022

Gradle Check (Jenkins) Run Completed with:

VachaShah Sep 27, 2022 • edited Loading

Choose a reason for hiding this comment

sashashura Sep 27, 2022

Choose a reason for hiding this comment

github-actions bot commented Sep 27, 2022

Gradle Check (Jenkins) Run Completed with:

github-actions bot commented Oct 5, 2022

Gradle Check (Jenkins) Run Completed with:

dblock commented Oct 5, 2022

dblock Oct 5, 2022

Choose a reason for hiding this comment

sashashura Oct 12, 2022

Choose a reason for hiding this comment

github-actions bot commented Oct 12, 2022

Gradle Check (Jenkins) Run Completed with:

github-actions bot commented Oct 12, 2022

Gradle Check (Jenkins) Run Completed with:

github-actions bot commented Oct 12, 2022

Gradle Check (Jenkins) Run Completed with:

github-actions bot commented Oct 12, 2022

Gradle Check (Jenkins) Run Completed with:

sashashura commented Oct 12, 2022

github-actions bot commented Oct 12, 2022

Gradle Check (Jenkins) Run Completed with:

github-actions bot commented Nov 30, 2022

Gradle Check (Jenkins) Run Completed with:

sashashura commented Nov 30, 2022

opensearch-trigger-bot bot commented Jan 30, 2023

mch2 commented Jan 30, 2023

codecov-commenter commented Sep 25, 2022 •

edited

Loading

VachaShah Sep 27, 2022 •

edited

Loading