Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

GITHUB_TOKEN permissions used by this action #111

Open
step-security-bot opened this issue Apr 6, 2022 · 3 comments
Open

GITHUB_TOKEN permissions used by this action #111

step-security-bot opened this issue Apr 6, 2022 · 3 comments

Comments

@step-security-bot
Copy link

At https://github.com/step-security/secure-workflows we are building a knowledge-base (KB) of GITHUB_TOKEN permissions needed by different GitHub Actions. When developers try to set minimum token permissions for their workflows, they can use this knowledge-base instead of trying to research permissions needed by each GitHub Action they use.

Below you can see the KB of your GITHUB Action.

name: 'GitHub Push'
github-token:
  action-input:
    input: github_token
    is-default: true
  permissions:
    contents: write
    contents-reason: to push local changes  #Checkout: https://github.com/ad-m/github-push-action#github-action-for-github-push 
    
#Fixes #496

If you think this information is not accurate, or if in the future your GitHub Action starts using a different set of permissions, please create an issue at https://github.com/step-security/secure-workflows/issues to let us know.

This issue is automatically created by our analysis bot, feel free to close after reading :)

References:

GitHub asks users to define workflow permissions, see https://github.blog/changelog/2021-04-20-github-actions-control-permissions-for-github_token/ and https://docs.github.com/en/actions/security-guides/automatic-token-authentication#modifying-the-permissions-for-the-github_token for securing GitHub workflows against supply-chain attacks.

Setting minimum token permissions is also checked for by Open Source Security Foundation (OpenSSF) Scorecards. Scorecards recommend using https://github.com/step-security/secure-workflows so developers can fix this issue in an easier manner.

@ZPascal
Copy link
Collaborator

ZPascal commented Apr 17, 2022

@ad-m I think it's not a bad idea to add the token permission to the documentation. What do you think ?

@ad-m
Copy link
Owner

ad-m commented May 3, 2022

What permission do we need for that API call?

const body = JSON.parse(await get(`${process.env.GITHUB_API_URL}/repos/${repository}`, { headers }))

@ZPascal
Copy link
Collaborator

ZPascal commented May 4, 2022

@ad-m I think we should add full repository and optional workflow access to the documentation. Should I prepare a PR?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants