From ee25db4e8e48ff9efecd31b00dc0942ae593c035 Mon Sep 17 00:00:00 2001 From: Muhammad Atif Ali Date: Wed, 30 Oct 2024 11:43:30 +0500 Subject: [PATCH] chore: tighten GitHub workflow permissions Align permissions with OpenSSF scorecard recommendations to enhance security. Move permissions to specific jobs to grant only what's necessary. --- .github/workflows/docker-base.yaml | 9 +++++---- .github/workflows/nightly-gauntlet.yaml | 4 ++++ .github/workflows/pr-cleanup.yaml | 6 +++--- .github/workflows/pr-deploy.yaml | 7 +++++-- .github/workflows/release-validation.yaml | 3 +++ .github/workflows/release.yaml | 14 ++++++++------ .github/workflows/stale.yaml | 15 +++++++++++++-- 7 files changed, 41 insertions(+), 17 deletions(-) diff --git a/.github/workflows/docker-base.yaml b/.github/workflows/docker-base.yaml index 8053b12780855..c0a3e87c5fe98 100644 --- a/.github/workflows/docker-base.yaml +++ b/.github/workflows/docker-base.yaml @@ -22,10 +22,6 @@ on: permissions: contents: read - # Necessary to push docker images to ghcr.io. - packages: write - # Necessary for depot.dev authentication. - id-token: write # Avoid running multiple jobs for the same commit. concurrency: @@ -33,6 +29,11 @@ concurrency: jobs: build: + permissions: + # Necessary for depot.dev authentication. + id-token: write + # Necessary to push docker images to ghcr.io. + packages: write runs-on: ubuntu-latest if: github.repository_owner == 'coder' steps: diff --git a/.github/workflows/nightly-gauntlet.yaml b/.github/workflows/nightly-gauntlet.yaml index 99ce3f62618a7..2b2887a13934e 100644 --- a/.github/workflows/nightly-gauntlet.yaml +++ b/.github/workflows/nightly-gauntlet.yaml @@ -6,6 +6,10 @@ on: # Every day at midnight - cron: "0 0 * * *" workflow_dispatch: + +permissions: + contents: read + jobs: go-race: # While GitHub's toaster runners are likelier to flake, we want consistency diff --git a/.github/workflows/pr-cleanup.yaml b/.github/workflows/pr-cleanup.yaml index ebcf097c0ef6b..f5cee03a4c6c4 100644 --- a/.github/workflows/pr-cleanup.yaml +++ b/.github/workflows/pr-cleanup.yaml @@ -8,12 +8,12 @@ on: description: "PR number" required: true -permissions: - packages: write - jobs: cleanup: runs-on: "ubuntu-latest" + permissions: + # Necessary to delete docker images from ghcr.io. + packages: write steps: - name: Harden Runner uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1 diff --git a/.github/workflows/pr-deploy.yaml b/.github/workflows/pr-deploy.yaml index 6ca35c82eebeb..49e73e9b0bf63 100644 --- a/.github/workflows/pr-deploy.yaml +++ b/.github/workflows/pr-deploy.yaml @@ -30,8 +30,6 @@ env: permissions: contents: read - packages: write - pull-requests: write # needed for commenting on PRs jobs: check_pr: @@ -171,6 +169,8 @@ jobs: needs: get_info if: needs.get_info.outputs.BUILD == 'true' || github.event.inputs.deploy == 'true' runs-on: "ubuntu-latest" + permissions: + pull-requests: write # needed for commenting on PRs steps: - name: Harden Runner uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1 @@ -205,6 +205,9 @@ jobs: # Run build job only if there are changes in the files that we care about or if the workflow is manually triggered with --build flag if: needs.get_info.outputs.BUILD == 'true' runs-on: ${{ github.repository_owner == 'coder' && 'depot-ubuntu-22.04-8' || 'ubuntu-latest' }} + permissions: + # Necessary to push docker images to ghcr.io. + packages: write # This concurrency only cancels build jobs if a new build is triggred. It will avoid cancelling the current deployemtn in case of docs chnages. concurrency: group: build-${{ github.workflow }}-${{ github.ref }}-${{ needs.get_info.outputs.BUILD }} diff --git a/.github/workflows/release-validation.yaml b/.github/workflows/release-validation.yaml index 405e051f78526..2f12ac2bb5e7b 100644 --- a/.github/workflows/release-validation.yaml +++ b/.github/workflows/release-validation.yaml @@ -5,6 +5,9 @@ on: tags: - "v*" +permissions: + contents: read + jobs: network-performance: runs-on: ubuntu-latest diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index b2757b25181d5..74b5b7b35a1e7 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -18,12 +18,7 @@ on: default: false permissions: - # Required to publish a release - contents: write - # Necessary to push docker images to ghcr.io. - packages: write - # Necessary for GCP authentication (https://github.com/google-github-actions/setup-gcloud#usage) - id-token: write + contents: read concurrency: ${{ github.workflow }}-${{ github.ref }} @@ -40,6 +35,13 @@ jobs: release: name: Build and publish runs-on: ${{ github.repository_owner == 'coder' && 'depot-ubuntu-22.04-8' || 'ubuntu-latest' }} + permissions: + # Required to publish a release + contents: write + # Necessary to push docker images to ghcr.io. + packages: write + # Necessary for GCP authentication (https://github.com/google-github-actions/setup-gcloud#usage) + id-token: write env: # Necessary for Docker manifest DOCKER_CLI_EXPERIMENTAL: "enabled" diff --git a/.github/workflows/stale.yaml b/.github/workflows/stale.yaml index a05632d181ed3..d055c4f451e4e 100644 --- a/.github/workflows/stale.yaml +++ b/.github/workflows/stale.yaml @@ -1,16 +1,21 @@ -name: Stale Issue, Banch and Old Workflows Cleanup +name: Stale Issue, Branch and Old Workflows Cleanup on: schedule: # Every day at midnight - cron: "0 0 * * *" workflow_dispatch: + +permissions: + contents: read + jobs: issues: runs-on: ubuntu-latest permissions: + # Needed to close issues. issues: write + # Needed to close PRs. pull-requests: write - actions: write steps: - name: Harden Runner uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1 @@ -86,6 +91,9 @@ jobs: branches: runs-on: ubuntu-latest + permissions: + # Needed to delete branches. + contents: write steps: - name: Harden Runner uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1 @@ -105,6 +113,9 @@ jobs: exclude_open_pr_branches: true del_runs: runs-on: ubuntu-latest + permissions: + # Needed to delete workflow runs. + actions: write steps: - name: Harden Runner uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1