From f0e263a4040f3b6a6941b93a14d60ae60bc4acb9 Mon Sep 17 00:00:00 2001 From: Alex Date: Thu, 1 Dec 2022 03:13:49 +0200 Subject: [PATCH] GitHub Workflows security hardening (#3624) * build: harden build.yaml permissions Signed-off-by: Alex * build: harden trigger-skeletons.yml permissions Signed-off-by: Alex * build: harden tests.yaml permissions Signed-off-by: Alex Signed-off-by: Alex --- .github/workflows/build.yaml | 8 ++++++++ .github/workflows/tests.yaml | 3 +++ .github/workflows/trigger-skeletons.yml | 3 +++ 3 files changed, 14 insertions(+) diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml index 53f95be15..d21bea1bc 100644 --- a/.github/workflows/build.yaml +++ b/.github/workflows/build.yaml @@ -4,8 +4,13 @@ on: release: types: [published] +permissions: {} + jobs: build: + permissions: + contents: write # for release creation (svenstaro/upload-release-action) + if: "!github.event.release.prerelease" runs-on: ubuntu-latest @@ -52,6 +57,9 @@ jobs: file_glob: true slack: + permissions: + actions: read # to list jobs for workflow run (technote-space/workflow-conclusion-action) + name: Slack needs: build runs-on: ubuntu-latest diff --git a/.github/workflows/tests.yaml b/.github/workflows/tests.yaml index 90ed324b9..f97fdfab9 100644 --- a/.github/workflows/tests.yaml +++ b/.github/workflows/tests.yaml @@ -6,6 +6,9 @@ on: pull_request: branches: [ develop ] +permissions: + contents: read # to fetch code (actions/checkout) + jobs: unit-tests: diff --git a/.github/workflows/trigger-skeletons.yml b/.github/workflows/trigger-skeletons.yml index bc4f1a0c1..b42b9630a 100644 --- a/.github/workflows/trigger-skeletons.yml +++ b/.github/workflows/trigger-skeletons.yml @@ -12,6 +12,9 @@ on: required: true default: true +permissions: + contents: read # to fetch code (actions/checkout) + jobs: build: runs-on: ubuntu-latest