-
Notifications
You must be signed in to change notification settings - Fork 525
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
OpenSSF scorecard "Token-permissions" score zero #3012
Comments
#3013 closes this issue? |
Not yet. I'm working on nodejs workflow. If everything ok I will close myself (else I will open another PR). |
My bad on that change. The GHA documentation is a bit bare on permissions, by not setting the global permissions does it essentially issue a full read-write token to the workflow? Edit: Nvm found it: https://docs.github.com/en/actions/security-guides/automatic-token-authentication Also just to confirm: Are job-level permissions additive to workflow-level? For example, in nightly at the workflow level we now have:
then the report-failure job within that workflow:
So there's no need to explicitly set |
I think it depend on the Github permission setting (but by default yes it has read-write almost everywhere).
Yes. The basic idea is to set read at the root and then assign the right permission by jobs. You can read more here about how OpenSSF scorecard build the score (there is also some tips and links). |
Hello there 👋,
Today in the Node.js security meeting we discussed that the undici project score had dropped due to a change in the workflows. This seems to be related to the following commit.
Full report here
undici/.github/workflows/nodejs.yml
Lines 102 to 105 in d3d24e2
Github Action Merge Dependabot require
pull-requests
andcontents
(not sure ifactions
is required). These warnings are perhaps to be ignored.@nodejs/security-wg
The text was updated successfully, but these errors were encountered: