Skip to content

Conversation

@MacOS
Copy link
Collaborator

@MacOS MacOS commented Mar 20, 2025

This PR adds the top level permission for read to restrct the GITHUB_TOKEN.

This PR makes all workflows more secure by restricting the permission of the GITHUB_TOKEN, and does remediy security alerts such as Token-Permissions, which look like

score is 0: no topLevel permission defined
Remediation tip: Visit [https://app.stepsecurity.io/secureworkflow](https://app.stepsecurity.io/secureworkflow/github.com/telekom/CityKey-Android/reuse-compliance.yml/main?enable=permissions).
Tick the 'Restrict permissions for GITHUB_TOKEN'
Untick other options
NOTE: If you want to resolve multiple issues at once, you can visit https://app.stepsecurity.io/securerepo instead.
Click Remediation section below for further remediation help

@MacOS MacOS added the build Changes to CI, CD, Issue templates, PR templates, and so on label Mar 20, 2025
@MacOS MacOS requested a review from BhaskarNS-iOS March 20, 2025 12:26
@MacOS MacOS self-assigned this Mar 20, 2025
@MacOS
Copy link
Collaborator Author

MacOS commented Apr 14, 2025

@BhaskarNS-iOS and @ShashilPohankar - please review my PR.

@MacOS MacOS requested a review from ShashilPohankar April 15, 2025 07:42
@MacOS MacOS requested a review from Copilot May 6, 2025 08:42
Copy link

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This PR enhances security by restricting the GITHUB_TOKEN permissions to read access across multiple GitHub Actions workflows.

  • Adds an explicit top-level permissions block setting 'contents: read' for the token.
  • Replaces a broader 'read-all' permission with a scoped 'contents: read' in the openssf-scorecard workflow.

Reviewed Changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 4 comments.

File Description
.github/workflows/reuse-compliance.yml Added top-level 'permissions: contents: read' block to restrict the token.
.github/workflows/oss-review-toolkit.yml Added top-level 'permissions: contents: read' block to restrict the token.
.github/workflows/openssf-scorecard.yml Replaced 'read-all' with 'permissions: contents: read' to scope the permission.
.github/workflows/continuous-integration.yml Added top-level 'permissions: contents: read' block to restrict the token.

permissions:
contents: read


Copy link

Copilot AI May 6, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[nitpick] Consider removing redundant blank lines after the permissions block to improve readability.

Suggested change

Copilot uses AI. Check for mistakes.
Comment on lines +20 to 25
permissions:
contents: read


jobs:
oss-review-toolkit:
Copy link

Copilot AI May 6, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[nitpick] Consider removing redundant blank lines following the permissions block for consistent formatting.

Suggested change
permissions:
contents: read
jobs:
oss-review-toolkit:
permissions:
contents: read
jobs:
oss-review-toolkit:

Copilot uses AI. Check for mistakes.
permissions:
contents: read


Copy link

Copilot AI May 6, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[nitpick] Consider removing redundant blank lines after the permissions block to maintain consistent formatting across workflow files.

Suggested change

Copilot uses AI. Check for mistakes.
Comment on lines +26 to 32
permissions:
contents: read


jobs:

swift-lint:
Copy link

Copilot AI May 6, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[nitpick] Consider removing redundant blank lines following the permissions block to maintain consistent formatting.

Suggested change
permissions:
contents: read
jobs:
swift-lint:
permissions:
contents: read
jobs:
swift-lint:

Copilot uses AI. Check for mistakes.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

build Changes to CI, CD, Issue templates, PR templates, and so on

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant