Remove all possible GitHub Action permissions

Set the GitHub Actions token permission to null in all workflows. This results in: GITHUB_TOKEN Permissions Metadata: read The default permissions, used without the null override, are: GITHUB_TOKEN Permissions Actions: read Checks: read Contents: read Deployments: read Discussions: read Issues: read Metadata: read Packages: read Pages: read PullRequests: read RepositoryProjects: read SecurityEvents: read Statuses: read I suspect the dependent issues job may need PullRequests: read Issues: read but it would be nice to verify it does fail without them. That's not possible to test from a PR because the job triggers from merged config. Relates-to: submariner-io/submariner#1740 Signed-off-by: Daniel Farrell <[email protected]>
submariner-io · Aug 22, 2022 · 8df79e6 · 8df79e6
1 parent dcc3359
commit 8df79e6
Show file tree

Hide file tree

Showing 13 changed files with 26 additions and 0 deletions.
diff --git a/.github/workflows/branch.yml b/.github/workflows/branch.yml
@@ -4,6 +4,8 @@ name: Branch Checks
 on:
   pull_request:
 
+permissions: {}
+
 jobs:
   target_branch:
     name: PR targets branch

diff --git a/.github/workflows/codeowners.yml b/.github/workflows/codeowners.yml
@@ -7,6 +7,8 @@ on:
       - 'CODEOWNERS'
       - 'CODEOWNERS.in'
 
+permissions: {}
+
 jobs:
   updated:
     name: Up-to-date

diff --git a/.github/workflows/dependent-issues.yml b/.github/workflows/dependent-issues.yml
@@ -19,6 +19,8 @@ on:
   schedule:
     - cron: '0 0/6 * * *'  # every 6 hours
 
+permissions: {}
+
 jobs:
   check:
     name: Check Dependencies

diff --git a/.github/workflows/e2e-full.yml b/.github/workflows/e2e-full.yml
@@ -5,6 +5,8 @@ on:
   pull_request:
     types: [labeled, opened, synchronize, reopened]
 
+permissions: {}
+
 jobs:
   e2e:
     name: E2E

diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml
@@ -4,6 +4,8 @@ name: End to End Default
 on:
   pull_request:
 
+permissions: {}
+
 jobs:
   e2e:
     name: E2E

diff --git a/.github/workflows/flake_finder.yml b/.github/workflows/flake_finder.yml
@@ -5,6 +5,8 @@ on:
   schedule:
     - cron: "0 0,1 * * *"
 
+permissions: {}
+
 jobs:
   e2e:
     name: E2E

diff --git a/.github/workflows/linting.yml b/.github/workflows/linting.yml
@@ -4,6 +4,8 @@ name: Linting
 on:
   pull_request:
 
+permissions: {}
+
 jobs:
   apply-suggestions-commits:
     name: 'No "Apply suggestions from code review" Commits'

diff --git a/.github/workflows/multiarch.yml b/.github/workflows/multiarch.yml
@@ -4,6 +4,8 @@ name: Multi-arch Builds
 on:
   pull_request:
 
+permissions: {}
+
 jobs:
   check-multiarch:
     name: Check the multi-arch builds

diff --git a/.github/workflows/periodic.yml b/.github/workflows/periodic.yml
@@ -5,6 +5,8 @@ on:
   schedule:
     - cron: "0 0 * * 0"
 
+permissions: {}
+
 jobs:
   markdown-link-check-periodic:
     name: Markdown Links (all files)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -7,6 +7,8 @@ on:
       - devel
       - release-*
 
+permissions: {}
+
 jobs:
   release:
     name: Release Images

diff --git a/.github/workflows/report.yml b/.github/workflows/report.yml
@@ -7,6 +7,8 @@ on:
       - devel
       - release-*
 
+permissions: {}
+
 jobs:
   unit-coverage:
     name: Go Unit Test Coverage

diff --git a/.github/workflows/unit.yml b/.github/workflows/unit.yml
@@ -4,6 +4,8 @@ name: Unit Tests
 on:
   pull_request:
 
+permissions: {}
+
 jobs:
   unit-testing:
     name: Go Unit Tests

diff --git a/.github/workflows/upgrade-e2e.yml b/.github/workflows/upgrade-e2e.yml
@@ -5,6 +5,8 @@ on:
   pull_request:
     branches: [devel]
 
+permissions: {}
+
 jobs:
   upgrade-e2e:
     name: Latest Release to Latest Version
-Original file line number
+Diff line change
@@ Expand Up / @@ -4,6 +4,8 @@ name: End to End Default @@
     on:
       pull_request:
+    permissions: {}
     jobs:
       e2e:
         name: E2E
@@ Expand Down @@