-
Notifications
You must be signed in to change notification settings - Fork 183
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
ci: add GitHub token permissions for workflow #2696
Conversation
Signed-off-by: Varun Sharma <varunsh@stepsecurity.io>
Thank you for your pull request and welcome to our community! To contribute, please sign the Oracle Contributor Agreement (OCA).
To sign the OCA, please create an Oracle account and sign the OCA in Oracle's Contributor Agreement Application. When singing the OCA, please provide your GitHub username. After signing the OCA and getting an OCA approval from Oracle, this PR will be automatically updated. |
I'm not sure what this gains. |
Hi @eregon, that is a good question. The threat this change is trying to mitigate is not from the maintainers who are trusted and have push access. The threat is if one of the components/ GitHub Actions used in the workflow are vulnerable or have been compromised, it can be used to exfiltrate the
HTH. Please let me know if you have any follow up questions. |
I'd like to understand the threat more in detail, to see how much this helps. The only actions used here are:
The If one of the It might also grant access to the Unfortunately both articles are very unclear about the actual issue. Something a bit worrying is https://github.com/actions/checkout/blob/2541b1294d2704b0964813337f33b291d3f8596b/action.yml#L14-L16 + https://github.com/actions/checkout/blob/2541b1294d2704b0964813337f33b291d3f8596b/action.yml#L48-L50:
That sounds like it saves the token in |
Alright, given how easy it is to get the token from |
Good point on the To answer your initial question, any GitHub Action can get access to the https://github.com/peter-evans/create-pull-request/blob/10db75894f6d53fc01c3bb0995e95bd03e583a62/action.yml#L6 Moreover, once the Action's So, if an attacker can compromise an Action, they can update the |
I remember trying that myself with @fniephaus and the result was this |
I changed the permissions in the repository settings, so now it's read-only: https://github.com/oracle/truffleruby/runs/7545551461?check_suite_focus=true |
w.r.t the OCA check which is failing, I did sign that one day back. may be it takes some time to propagate here... |
This PR adds minimum token permissions for the GITHUB_TOKEN.
GitHub recommends defining minimum GITHUB_TOKEN permissions for securing GitHub Actions workflows
Signed-off-by: Varun Sharma varunsh@stepsecurity.io
Before this change
GITHUB_TOKEN
haswrite
permissions for multiple scopes which are not needed.e.g. https://github.com/oracle/truffleruby/runs/7521413259?check_suite_focus=true#step:1:16
After this change
GITHUB_TOKEN
will have minimum permissions needed