Make documentation for actions more accurate

ossf · Feb 25, 2022 · e346208 · e346208
1 parent 659ca06
commit e346208
Show file tree

Hide file tree

Showing 3 changed files with 3 additions and 3 deletions.
diff --git a/checks/permissions.go b/checks/permissions.go
@@ -342,7 +342,7 @@ func calculateScore(result permissionCbData) int {
 		}
 
 		// actions.
-		// May allow an attacker to steal GitHub secrets by adding a malicious workflow/action.
+		// May allow an attacker to steal GitHub secrets by approving to run an action that needs approval.
 		// High risk: -10
 		if permissionIsPresent(perms, permissionActions) {
 			score -= checker.MaxResultScore

diff --git a/docs/checks.md b/docs/checks.md
@@ -581,7 +581,7 @@ Additionally, points are reduced if certain write permissions are defined for a
 ### Write permissions causing a large reduction
 * `contents` - Allows an attacker to commit unreviewed code. However, points are not reduced if the job utilizes a recognized packaging action or command.
 * `packages` - Allows an attacker to publish packages. However, points are not reduced if the job utilizes a recognized packaging action or command.
-* `actions` - May allow an attacker to steal GitHub secrets by adding a malicious workflow or action.
+* `actions` - May allow an attacker to steal GitHub secrets by approving to run an action that needs approval.
 
 
 **Remediation steps**

diff --git a/docs/checks/internal/checks.yaml b/docs/checks/internal/checks.yaml
@@ -633,7 +633,7 @@ checks:
       ### Write permissions causing a large reduction
       * `contents` - Allows an attacker to commit unreviewed code. However, points are not reduced if the job utilizes a recognized packaging action or command.
       * `packages` - Allows an attacker to publish packages. However, points are not reduced if the job utilizes a recognized packaging action or command.
-      * `actions` - May allow an attacker to steal GitHub secrets by adding a malicious workflow or action.
+      * `actions` - May allow an attacker to steal GitHub secrets by approving to run an action that needs approval.
  
     remediation:
       - >-