Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Use minimum GITHUB_TOKEN permissions for each job #1740

Closed
dfarrell07 opened this issue Mar 17, 2022 · 8 comments
Closed

Use minimum GITHUB_TOKEN permissions for each job #1740

dfarrell07 opened this issue Mar 17, 2022 · 8 comments
Assignees
@dfarrell07
Labels
automation dependent priority:high size:medium This can be implemented in a single sprint

Comments

@dfarrell07
Copy link
Member

dfarrell07 commented Mar 17, 2022 •
edited
Loading

The GITHUB_TOKEN used by some GitHub Actions can be configured to permissive or restricted. We currently use permissive as a GitHub Organizational default. We should instead use restricted as the GitHub Organizational default and explicitly grant the minimum required permissions to each job/workflow.

You can use the permissions key in your workflow file to modify permissions for the GITHUB_TOKEN for an entire workflow or for individual jobs. This allows you to configure the minimum required permissions for a workflow or job. When the permissions key is used, all unspecified permissions are set to no access, with the exception of the metadata scope, which always gets read access.

https://docs.github.com/en/actions/security-guides/automatic-token-authentication#modifying-the-permissions-for-the-github_token

Example per-workflow: https://docs.github.com/en/actions/security-guides/automatic-token-authentication#example-1-passing-the-github_token-as-an-input

Example per-job: https://docs.github.com/en/actions/security-guides/automatic-token-authentication#example-2-calling-the-rest-api

Depends on #2042
Depends on #2054
Depends on #1799
Depends on submariner-io/admiral#438
Depends on submariner-io/cloud-prepare#424
Depends on submariner-io/lighthouse#913
Depends on submariner-io/releases#515
Depends on submariner-io/shipyard#994
Depends on submariner-io/subctl#310
Depends on submariner-io/submariner-charts#284
Depends on submariner-io/submariner-operator#2292
Depends on submariner-io/submariner-website#839
Depends on submariner-io/enhancements#140
@dfarrell07 dfarrell07 self-assigned this Mar 17, 2022
@dfarrell07 dfarrell07 added size:medium This can be implemented in a single sprint next-version-candidate labels Mar 21, 2022
dfarrell07 added a commit to dfarrell07/submariner that referenced this issue Mar 23, 2022
@dfarrell07
Use Dependabot to update GHAs, now supports SHAs
c1def8b 
This is a bit of a test of Dependabot's support for managing SHA-based
versions of GitHub Actions.

In the original press release about Dependabot's support for GHAs,
they say:

> Dependabot creates pull requests that update the action to the latest
released tag (e.g., v2), regardless of if you’re currently on a release
tag, a pre-release tag, or a specific hash.

github.blog/2020-06-25-dependabot-now-updates-your-actions-workflows/

But I think SHA-based updates were added as a part of:

dependabot/dependabot-core#2835

I see examples where Dependabot apparently works with SHAs:

https://github.com/systemd/systemd/pull/22638/files
https://github.com/google/go-github/pull/2049/files

And those projects are using config like is proposed here:

https://github.com/systemd/systemd/blob/main/.github/dependabot.yml#L5
https://github.com/google/go-github/blob/master/.github/dependabot.yml#L15

As always, we should be careful about taking updates from third parties
and review theses PRs to update GHAs carefully. Especially until submariner-io#1740
reduces the permissions of each job to the minimum required.

Signed-off-by: Daniel Farrell <[email protected]>
@dfarrell07 dfarrell07 mentioned this issue Mar 23, 2022
Merged
dfarrell07 added a commit that referenced this issue Mar 28, 2022
@dfarrell07
Use Dependabot to update GHAs, now supports SHAs
b7ddbfa 
This is a bit of a test of Dependabot's support for managing SHA-based
versions of GitHub Actions.

In the original press release about Dependabot's support for GHAs,
they say:

> Dependabot creates pull requests that update the action to the latest
released tag (e.g., v2), regardless of if you’re currently on a release
tag, a pre-release tag, or a specific hash.

github.blog/2020-06-25-dependabot-now-updates-your-actions-workflows/

But I think SHA-based updates were added as a part of:

dependabot/dependabot-core#2835

I see examples where Dependabot apparently works with SHAs:

https://github.com/systemd/systemd/pull/22638/files
https://github.com/google/go-github/pull/2049/files

And those projects are using config like is proposed here:

https://github.com/systemd/systemd/blob/main/.github/dependabot.yml#L5
https://github.com/google/go-github/blob/master/.github/dependabot.yml#L15

As always, we should be careful about taking updates from third parties
and review theses PRs to update GHAs carefully. Especially until #1740
reduces the permissions of each job to the minimum required.

Signed-off-by: Daniel Farrell <[email protected]>
astoycos pushed a commit to astoycos/submariner that referenced this issue Apr 14, 2022
@dfarrell07 @astoycos
Use Dependabot to update GHAs, now supports SHAs
74f1603 
This is a bit of a test of Dependabot's support for managing SHA-based
versions of GitHub Actions.

In the original press release about Dependabot's support for GHAs,
they say:

> Dependabot creates pull requests that update the action to the latest
released tag (e.g., v2), regardless of if you’re currently on a release
tag, a pre-release tag, or a specific hash.

github.blog/2020-06-25-dependabot-now-updates-your-actions-workflows/

But I think SHA-based updates were added as a part of:

dependabot/dependabot-core#2835

I see examples where Dependabot apparently works with SHAs:

https://github.com/systemd/systemd/pull/22638/files
https://github.com/google/go-github/pull/2049/files

And those projects are using config like is proposed here:

https://github.com/systemd/systemd/blob/main/.github/dependabot.yml#L5
https://github.com/google/go-github/blob/master/.github/dependabot.yml#L15

As always, we should be careful about taking updates from third parties
and review theses PRs to update GHAs carefully. Especially until submariner-io#1740
reduces the permissions of each job to the minimum required.

Signed-off-by: Daniel Farrell <[email protected]>
astoycos pushed a commit to astoycos/submariner that referenced this issue Apr 14, 2022
@dfarrell07 @astoycos
Use Dependabot to update GHAs, now supports SHAs
cfd2a94 
This is a bit of a test of Dependabot's support for managing SHA-based
versions of GitHub Actions.

In the original press release about Dependabot's support for GHAs,
they say:

> Dependabot creates pull requests that update the action to the latest
released tag (e.g., v2), regardless of if you’re currently on a release
tag, a pre-release tag, or a specific hash.

github.blog/2020-06-25-dependabot-now-updates-your-actions-workflows/

But I think SHA-based updates were added as a part of:

dependabot/dependabot-core#2835

I see examples where Dependabot apparently works with SHAs:

https://github.com/systemd/systemd/pull/22638/files
https://github.com/google/go-github/pull/2049/files

And those projects are using config like is proposed here:

https://github.com/systemd/systemd/blob/main/.github/dependabot.yml#L5
https://github.com/google/go-github/blob/master/.github/dependabot.yml#L15

As always, we should be careful about taking updates from third parties
and review theses PRs to update GHAs carefully. Especially until submariner-io#1740
reduces the permissions of each job to the minimum required.

Signed-off-by: Daniel Farrell <[email protected]>
anfredette pushed a commit that referenced this issue Apr 15, 2022
@dfarrell07 @anfredette
Use Dependabot to update GHAs, now supports SHAs
22d7e86 
This is a bit of a test of Dependabot's support for managing SHA-based
versions of GitHub Actions.

In the original press release about Dependabot's support for GHAs,
they say:

> Dependabot creates pull requests that update the action to the latest
released tag (e.g., v2), regardless of if you’re currently on a release
tag, a pre-release tag, or a specific hash.

github.blog/2020-06-25-dependabot-now-updates-your-actions-workflows/

But I think SHA-based updates were added as a part of:

dependabot/dependabot-core#2835

I see examples where Dependabot apparently works with SHAs:

https://github.com/systemd/systemd/pull/22638/files
https://github.com/google/go-github/pull/2049/files

And those projects are using config like is proposed here:

https://github.com/systemd/systemd/blob/main/.github/dependabot.yml#L5
https://github.com/google/go-github/blob/master/.github/dependabot.yml#L15

As always, we should be careful about taking updates from third parties
and review theses PRs to update GHAs carefully. Especially until #1740
reduces the permissions of each job to the minimum required.

Signed-off-by: Daniel Farrell <[email protected]>
@dfarrell07
Copy link
Member Author

Better docs: https://docs.github.com/en/actions/using-jobs/assigning-permissions-to-jobs

@dfarrell07
Copy link
Member Author

It's weird this doesn't fail: submariner-io/lighthouse#821

Maybe the permissions changes don't take effect on PRs to prevent some attacks? Maybe they have to be merged?

@dfarrell07 dfarrell07 mentioned this issue Aug 19, 2022
Merged
dfarrell07 added a commit to dfarrell07/lighthouse that referenced this issue Aug 19, 2022
@dfarrell07
Remove all possible GitHub Action permissions
0ac73af 
Set the GitHub Actions token permission to null in all workflows.

This results in:

GITHUB_TOKEN Permissions
  Metadata: read

The default permissions, used without the null override, are:

GITHUB_TOKEN Permissions
  Actions: read
  Checks: read
  Contents: read
  Deployments: read
  Discussions: read
  Issues: read
  Metadata: read
  Packages: read
  Pages: read
  PullRequests: read
  RepositoryProjects: read
  SecurityEvents: read
  Statuses: read

I suspect the dependent issues job may need

  PullRequests: read
  Issues: read

but it would be nice to verify it does fail without them. That's not
possible to test from a PR because the job triggers from merged config.

Relates-to: submariner-io/submariner#1740
Signed-off-by: Daniel Farrell <[email protected]>
tpantelis pushed a commit to submariner-io/lighthouse that referenced this issue Aug 22, 2022
@dfarrell07 @tpantelis
Remove all possible GitHub Action permissions
8df79e6 
Set the GitHub Actions token permission to null in all workflows.

This results in:

GITHUB_TOKEN Permissions
  Metadata: read

The default permissions, used without the null override, are:

GITHUB_TOKEN Permissions
  Actions: read
  Checks: read
  Contents: read
  Deployments: read
  Discussions: read
  Issues: read
  Metadata: read
  Packages: read
  Pages: read
  PullRequests: read
  RepositoryProjects: read
  SecurityEvents: read
  Statuses: read

I suspect the dependent issues job may need

  PullRequests: read
  Issues: read

but it would be nice to verify it does fail without them. That's not
possible to test from a PR because the job triggers from merged config.

Relates-to: submariner-io/submariner#1740
Signed-off-by: Daniel Farrell <[email protected]>
@dfarrell07
Copy link
Member Author

@nyechiel
Copy link
Member

@dfarrell07 is there anything left for review here?

@dfarrell07 dfarrell07 mentioned this issue Sep 30, 2022
Closed
@dfarrell07
Copy link
Member Author

@dfarrell07 is there anything left for review here?

The periodic markdown link check job's permissions still need tweaking, I'll use Depends on to track.

@github-actions github-actions bot removed the dependent label Oct 5, 2022
@dfarrell07
Copy link
Member Author

Broken link job permissions are sorted out: #2063

@github-actions
Copy link
Contributor

github-actions bot commented Oct 17, 2022 •
edited
Loading

This PR/issue depends on:

dfarrell07 added a commit to dfarrell07/admiral that referenced this issue Oct 19, 2022
@dfarrell07
Add issues:write permission to broken links GHA
30696a0 
The issue reporting step of the Markdown broken link check GitHub Action
is failing due to missing permissions.

> Error: Resource not accessible by integration

Relates-to: submariner-io/submariner#1740
Signed-off-by: Daniel Farrell <[email protected]>
@dfarrell07 dfarrell07 mentioned this issue Oct 19, 2022
Merged
dfarrell07 added a commit to dfarrell07/lighthouse that referenced this issue Oct 19, 2022
@dfarrell07
Add issues:write permission to broken links GHA
56421a0 
The issue reporting step of the Markdown broken link check GitHub Action
is failing due to missing permissions.

> Error: Resource not accessible by integration

Relates-to: submariner-io/submariner#1740
Signed-off-by: Daniel Farrell <[email protected]>
@dfarrell07 dfarrell07 mentioned this issue Oct 19, 2022
Merged
dfarrell07 added a commit to dfarrell07/releases that referenced this issue Oct 19, 2022
@dfarrell07
Add issues:write permission to broken links GHA
f5107af 
The issue reporting step of the Markdown broken link check GitHub Action is failing due to missing permissions.

> Error: Resource not accessible by integration

Relates-to: submariner-io/submariner#1740
Signed-off-by: Daniel Farrell <[email protected]>
skitt pushed a commit to submariner-io/lighthouse that referenced this issue Oct 19, 2022
@dfarrell07 @skitt
Add issues:write permission to broken links GHA
199c026 
The issue reporting step of the Markdown broken link check GitHub Action
is failing due to missing permissions.

> Error: Resource not accessible by integration

Relates-to: submariner-io/submariner#1740
Signed-off-by: Daniel Farrell <[email protected]>
skitt pushed a commit to submariner-io/admiral that referenced this issue Oct 19, 2022
@dfarrell07 @skitt
Add issues:write permission to broken links GHA
4efc18a 
The issue reporting step of the Markdown broken link check GitHub Action
is failing due to missing permissions.

> Error: Resource not accessible by integration

Relates-to: submariner-io/submariner#1740
Signed-off-by: Daniel Farrell <[email protected]>
dfarrell07 added a commit to dfarrell07/releases that referenced this issue Oct 20, 2022
@dfarrell07
Add issues:write permission to broken links GHA
e7f4b63 
The issue reporting step of the Markdown broken link check GitHub Action
is failing due to missing permissions.

> Error: Resource not accessible by integration

Relates-to: submariner-io/submariner#1740
Signed-off-by: Daniel Farrell <[email protected]>
dfarrell07 added a commit to dfarrell07/enhancements that referenced this issue Oct 20, 2022
@dfarrell07
Add issues:write permission to broken links GHA
ed42171 
The issue reporting step of the Markdown broken link check GitHub Action
is failing due to missing permissions.

> Error: Resource not accessible by integration

Relates-to: submariner-io/submariner#1740
Signed-off-by: Daniel Farrell <[email protected]>
@tpantelis tpantelis mentioned this issue Oct 20, 2022
Closed
tpantelis pushed a commit to submariner-io/releases that referenced this issue Oct 21, 2022
@dfarrell07 @tpantelis
Add issues:write permission to broken links GHA
ad47c69 
The issue reporting step of the Markdown broken link check GitHub Action
is failing due to missing permissions.

> Error: Resource not accessible by integration

Relates-to: submariner-io/submariner#1740
Signed-off-by: Daniel Farrell <[email protected]>
skitt pushed a commit to submariner-io/enhancements that referenced this issue Oct 24, 2022
@dfarrell07 @skitt
Add issues:write permission to broken links GHA
3e7eb60 
The issue reporting step of the Markdown broken link check GitHub Action
is failing due to missing permissions.

> Error: Resource not accessible by integration

Relates-to: submariner-io/submariner#1740
Signed-off-by: Daniel Farrell <[email protected]>
@skitt
Copy link
Member

skitt commented Oct 24, 2022

This has been completed.

@skitt skitt closed this as completed Oct 24, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@dfarrell07 dfarrell07

Labels
automation dependent priority:high size:medium This can be implemented in a single sprint
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
4 participants
@dfarrell07 @skitt @nyechiel @maayanf24