ci: Update GitHub Actions workflows to follow principle of least privilege #87254
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
kartben
force-pushed
the
workflows_permissions
branch
4 times, most recently
from
e813675 to
8b00760
Compare
zephyrbot
added
platform: nRF BSIM
zephyrbot
requested review from
aescolar,
fabiobaltieri,
nashif and
stephanosio
kartben
force-pushed
the
workflows_permissions
branch
from
8b00760 to
71e8060
Compare
zephyrbot
requested review from
asbjornsabo,
Casper-Bonde-Bose,
fredrikdanebjer,
jhedberg,
jthm-ot,
larsgk,
MariuszSkamra,
niym-ot,
pin-zephyr,
sjanc and
Thalley
kartben
force-pushed
the
workflows_permissions
branch
from
71e8060 to
e1df96c
Compare
kartben
removed request for
larsgk,
jhedberg,
Thalley,
MariuszSkamra,
sjanc,
fredrikdanebjer,
asbjornsabo,
Casper-Bonde-Bose,
pin-zephyr,
niym-ot and
jthm-ot
nashif
previously approved these changes
Mar 18, 2025
fabiobaltieri
requested changes
Mar 18, 2025
kartben
force-pushed
the
workflows_permissions
branch
from
e1df96c to
e973242
Compare
Sigh -- thanks! Should be better now |
nashif
previously approved these changes
Mar 18, 2025
fabiobaltieri
previously approved these changes
Mar 18, 2025
nashif
reviewed
Mar 18, 2025
| @@ -15,6 +15,9 @@ on: | |||
| # Run at 17:00 UTC on every Saturday | |||
| - cron: '0 17 * * 6' | |||
|
|
|||
| permissions: | |||
| contents: read | |||
|
|
|||
There was a problem hiding this comment.
shouldn't this action have checks: write permissions in 'Publish Unit Test Results' section below?
There was a problem hiding this comment.
yes! thanks for paying attention
There was a problem hiding this comment.
@nashif addressed - thanks!
…ilege Default to `permissions: read-all` in all workflows and then add additional permissions as needed at the job level Signed-off-by: Benjamin Cabé <benjamin@zephyrproject.org>
kartben
force-pushed
the
workflows_permissions
branch
from
e973242 to
ed9c558
Compare
fabiobaltieri
approved these changes
Mar 18, 2025
nashif
approved these changes
Mar 19, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Default to only giving
contents: readpermission in all workflows and then add additional permissions as needed at the job level.This shall get us a 10/10 for the Token-Permissions category in the OpenSSF score card :)
Note for reviewers, actions/upload-artifact actions/download-artifact are apparently "special" and don't require extra permissions.