New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
ci: add GitHub token permissions for workflows #17781
Conversation
|
This pull request has been automatically marked as Review Needed because it has been there has not been any activity for 7 days. |
|
@varunsh-coder Can you rebase your branch? |
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
Signed-off-by: Varun Sharma <varunsh@stepsecurity.io>
|
This PR has Quantification details
Why proper sizing of changes matters
Optimal pull request sizes drive a better predictable PR flow as they strike a
What can I do to optimize my changes
How to interpret the change counts in git diff output
Was this comment helpful? |
Done |
|
/azp run PowerShell-CI-windows |
|
Azure Pipelines successfully started running 1 pipeline(s). |
|
/remind me tomorrow |
|
@TravisEz13 set a reminder for 8/5/2022 |
|
@varunsh-coder Thanks for your contribution. |
|
Handy links: |


PR Summary
This PR adds minimum token permissions for the GITHUB_TOKEN in GitHub Actions workflows using https://github.com/step-security/secure-workflows.
PR Context
GitHub recommends defining minimum GITHUB_TOKEN permissions for securing GitHub Actions workflows
This project is part of the top 100 critical projects as per OpenSSF (https://github.com/ossf/wg-securing-critical-projects), so fixing the token permissions to improve security.
Before the change:
GITHUB_TOKENhaswritepermissions for multiple scopes, e.g.https://github.com/PowerShell/PowerShell/runs/7530874225?check_suite_focus=true#step:1:19
After the change:
GITHUB_TOKENwill have minimum permissions needed for the jobs.Signed-off-by: Varun Sharma varunsh@stepsecurity.io
PR Checklist
.h,.cpp,.cs,.ps1and.psm1files have the correct copyright headerWIP:or[ WIP ]to the beginning of the title (theWIPbot will keep its status check atPendingwhile the prefix is present) and remove the prefix when the PR is ready.(which runs in a different PS Host).