Repository navigation
chore(ci): declare the workflow token scopes, pin the one floating action and stop persisting checkout credentials - #8463
Open
Totara-thib wants to merge 3 commits into
Open
Totara-thib wants to merge 3 commits into
Totara-thib wants to merge 3 commits into
Conversation
Every action in the workflows is already referenced by commit except apify/actions/execute-workflow@v1.6.2, which triggers the release workflow from the tests job. A tag is a movable pointer, so it now points at the commit the tag resolves to today, with the tag kept as a comment.
…e token tests.yml and codeql-analysis.yml had no permissions block, so their ten jobs received the repository's default token scopes. The build, lint, test, bench and docs jobs only read the repository, they get a read-only token. The release job dispatches release.yml through the job token, so it keeps actions: write. CodeQL uploads its results, so it keeps security-events: write.
…th git actions/checkout writes the job token into .git/config by default, so every later step, including third-party actions and the packages yarn installs, can read it. Eleven of the fourteen checkouts never push: they build, lint, test, benchmark or deploy the docs through the Pages action. Those eleven no longer keep the token. The three release.yml checkouts that commit and push version bumps with the GH_TOKEN they are given keep it.
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Hi there, three commits on the workflows.
actions: writeon the release job that dispatches release.yml,security-events: writefor CodeQL.apify/actions/execute-workflow@v1.6.2moves to its commit, the tag kept as a comment.Why: a job that only builds and tests should not hold a token that can write, and release.yml publishes every package to npm and pushes tags and docs with a personal token. The default token scopes are wider than any of them need.
Found and fixed by Plumber's analysis, reviewed and submitted by me.