ci: declare workflow-level contents: read on 5 workflows#1066
Conversation
|
@arpitjain099 is attempting to deploy a commit to the Curated Tests - Permanent E2E Team on Vercel. A member of the Team first needs to authorize it. |
|
vvo
left a comment
vvo
left a comment
There was a problem hiding this comment.
LGTM. Additive workflow-level contents: read hardening; matches the OpenSSF Scorecard Token-Permissions pattern. Verified each touched workflow only does checkout + build/test/deprecate and makes no GitHub API calls beyond that.
|
@arpitjain099 We require signed commits: https://docs.github.com/en/authentication/managing-commit-signature-verification/signing-commits can you do that? thx |
@vvo sure. Let me do it tonight after getting back home. |
Pins the default GITHUB_TOKEN to contents: read on the workflows in .github/workflows/ that don't call a GitHub API beyond the initial checkout. The other workflows in this directory are left implicit because they need write scopes that a maintainer is better placed to declare. Motivation: CVE-2025-30066 (March 2025 tj-actions/changed-files compromise) exfiltrated GITHUB_TOKEN from workflow logs. Per-workflow caps bound runtime authority irrespective of repo or org default, give drift protection if the default ever widens, and are credited per-file by the OpenSSF Scorecard Token-Permissions check. YAML validated locally with yaml.safe_load. Signed-off-by: Arpit Jain <arpitjain099@gmail.com>
arpitjain099
force-pushed
the
chore/declare-workflow-perms-readonly
branch
from
cc1f1c9 to
52f4a99
Compare
|
@vvo done - rebased and re-signed with SSH. Commit should now show as Verified. |
2 participants
Pins the default
GITHUB_TOKENtocontents: readon 5 workflows in.github/workflows/that don't call a GitHub API beyond the initial checkout.The following files were left implicit because they reference
GITHUB_TOKEN/ use a write-scope action / trigger onpull_request_target. Those scopes are best declared by maintainers:integration-tests-live.yml.Why
CVE-2025-30066 (March 2025
tj-actions/changed-filessupply-chain compromise) exfiltratedGITHUB_TOKENfrom workflow logs. Pinning per workflow caps runtime authority irrespective of the repo or org default, gives drift protection if the default ever widens, and is credited per-file by the OpenSSF ScorecardToken-Permissionscheck.YAML validated locally with
yaml.safe_loadon each touched file.