-
Notifications
You must be signed in to change notification settings - Fork 1.5k
GitHub Workflows security hardening #3675
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
Signed-off-by: Alex <aleksandrosansan@gmail.com>
Signed-off-by: Alex <aleksandrosansan@gmail.com>
Signed-off-by: Alex <aleksandrosansan@gmail.com>
sashashura
commented
Dec 1, 2022
@jrfnl @gsherwood could you please review?
sashashura
commented
Dec 1, 2022
An example of a workflow run with unrestricted permissions:
image
jrfnl
commented
Dec 1, 2022
@sashashura No. Sorry, but a first time contribution to a repo from someone who's never interacted with the repo before, who has no (public) history on Git (and IIRC when I first looked when the PR was originally pulled, a public history, with no contributions) and who claims something is a security improvement raises all sorts of questions and suspicions for me.
I will not review this PR. I will do my own research when I find the time and then I'll see.
sashashura
commented
Dec 1, 2022
ok
sashashura
commented
Dec 1, 2022
I mean I provided some links you can read more about it and make your own judgement. I understand open source is after work activity, but it just two months passed and this is the first reply I got 😄
jrfnl
commented
Dec 1, 2022
Yeah so ? If you understand open source, you should know not to whine about that (aside from that: I'm not the maintainer).
Also links provided by an OP I don't trust, means I don't trust those links either.
TimWolla
commented
Jan 12, 2023
who claims something is a security improvement raises all sorts of questions and suspicions for me.
FWIW: The claims are correct. The same effective change was also applied to PHP itself in php/php-src@1d45ca5.
means I don't trust those links either.
Those go directly to GitHub's documentation, not some third party resource.
This PR adds explicit permissions section to workflows. This is a security best practice because by default workflows run with extended set of permissions (except from
on: pull_requestfrom external forks). By specifying any permission explicitly all others are set to none. By using the principle of least privilege the damage a compromised workflow can do (because of an injection or compromised third party tool or action) is restricted.It is recommended to have most strict permissions on the top level and grant write permissions on job level case by case.