-
Notifications
You must be signed in to change notification settings - Fork 1
[BUILD] Add top level permission restriction for GITHUB_TOKEN #60
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Conversation
…rict GITHUB_TOKEN so to be consistent with the others
|
@BhaskarNS-iOS and @ShashilPohankar - please review my PR. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Pull Request Overview
This PR enhances security by restricting the GITHUB_TOKEN permissions to read access across multiple GitHub Actions workflows.
- Adds an explicit top-level permissions block setting 'contents: read' for the token.
- Replaces a broader 'read-all' permission with a scoped 'contents: read' in the openssf-scorecard workflow.
Reviewed Changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 4 comments.
| File | Description |
|---|---|
| .github/workflows/reuse-compliance.yml | Added top-level 'permissions: contents: read' block to restrict the token. |
| .github/workflows/oss-review-toolkit.yml | Added top-level 'permissions: contents: read' block to restrict the token. |
| .github/workflows/openssf-scorecard.yml | Replaced 'read-all' with 'permissions: contents: read' to scope the permission. |
| .github/workflows/continuous-integration.yml | Added top-level 'permissions: contents: read' block to restrict the token. |
| permissions: | ||
| contents: read | ||
|
|
||
|
|
Copilot
AI
May 6, 2025
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
[nitpick] Consider removing redundant blank lines after the permissions block to improve readability.
| permissions: | ||
| contents: read | ||
|
|
||
|
|
||
| jobs: | ||
| oss-review-toolkit: |
Copilot
AI
May 6, 2025
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
[nitpick] Consider removing redundant blank lines following the permissions block for consistent formatting.
| permissions: | |
| contents: read | |
| jobs: | |
| oss-review-toolkit: | |
| permissions: | |
| contents: read | |
| jobs: | |
| oss-review-toolkit: |
| permissions: | ||
| contents: read | ||
|
|
||
|
|
Copilot
AI
May 6, 2025
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
[nitpick] Consider removing redundant blank lines after the permissions block to maintain consistent formatting across workflow files.
| permissions: | ||
| contents: read | ||
|
|
||
|
|
||
| jobs: | ||
|
|
||
| swift-lint: |
Copilot
AI
May 6, 2025
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
[nitpick] Consider removing redundant blank lines following the permissions block to maintain consistent formatting.
| permissions: | |
| contents: read | |
| jobs: | |
| swift-lint: | |
| permissions: | |
| contents: read | |
| jobs: | |
| swift-lint: |
This
PRadds the top level permission for read to restrct theGITHUB_TOKEN.This
PRmakes all workflows more secure by restricting the permission of theGITHUB_TOKEN, and does remediy security alerts such as Token-Permissions, which look like