chore: GitHub Workflows security hardening #5672
Conversation
Signed-off-by: Alex Low <aleksandrosansan@gmail.com>
Signed-off-by: Alex Low <aleksandrosansan@gmail.com>
|
Thanks for the PR, @sashashura! typescript-eslint is a 100% community driven project, and we are incredibly grateful that you are contributing to that community. The core maintainers work on this in their personal time, so please understand that it may not be possible for them to review your work immediately. Thanks again! 🙏 Please, if you or your company is finding typescript-eslint valuable, help us sustain the project by sponsoring it transparently on https://opencollective.com/typescript-eslint. As a thank you, your profile/company logo will be added to our main README which receives thousands of unique visitors per day. |
✅ Deploy Preview for typescript-eslint ready!
To edit notification comments on pull requests, go to your Netlify site settings. |
Codecov Report
Additional details and impacted files@@ Coverage Diff @@
## main #5672 +/- ##
==========================================
- Coverage 93.82% 91.01% -2.82%
==========================================
Files 134 365 +231
Lines 1506 11962 +10456
Branches 226 3483 +3257
==========================================
+ Hits 1413 10887 +9474
- Misses 60 781 +721
- Partials 33 294 +261
Flags with carried forward coverage won't be shown. Click here to find out more.
|
This PR adds explicit permissions section to workflows. This is a security best practice because by default workflows run with extended set of permissions (except from
on: pull_requestfrom external forks). By specifying any permission explicitly all others are set to none. By using the principle of least privilege the damage a compromised workflow can do (because of an injection or compromised third party tool or action) is restricted.It is recommended to have most strict permissions on the top level and grant write permissions on job level case by case.