FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

ci: add GitHub token permissions by varunsh-coder · Pull Request #92999 · python/cpython · GitHub

/ cpython Public

ci: add GitHub token permissions - #92999

Merged
ewdurbin merged 1 commit into
python:mainfrom
varunsh-coder:token-perms
May 21, 2022
ConversationCommits (1)ChecksFiles changed
Merged

ci: add GitHub token permissions#92999
ewdurbin merged 1 commit into
python:mainfrom
varunsh-coder:token-perms

Conversation

varunsh-coder commented May 20, 2022

Copy link
Copy Markdown
Contributor

GitHub asks developers to define workflow permissions, see https://github.blog/changelog/2021-04-20-github-actions-control-permissions-for-github_token/ and https://docs.github.com/en/actions/security-guides/automatic-token-authentication#modifying-the-permissions-for-the-github_token for securing GitHub workflows against supply-chain attacks.

The Open Source Security Foundation (OpenSSF) Scorecards also treats not setting token permissions as a high-risk issue.

This PR adds minimum token permissions for the GITHUB_TOKEN using https://github.com/step-security/secure-workflows.

This project is part of the top 100 critical projects as per OpenSSF (https://github.com/ossf/wg-securing-critical-projects), so fixing the token permissions to improve security.

ghost commented May 20, 2022 •
edited by ghost
Loading

Copy link
Copy Markdown

All commit authors signed the Contributor License Agreement.

bedevere-bot commented May 20, 2022

Copy link
Copy Markdown

Most changes to Python require a NEWS entry.

Please add it using the blurb_it web app or the blurb command-line tool.

varunsh-coder mentioned this pull request May 20, 2022
Open
erlend-aasland requested review from ewdurbin and zware May 20, 2022 07:28
ewdurbin mentioned this pull request May 21, 2022
Merged
ewdurbin merged commit b96e20c into python:main May 21, 2022

ewdurbin commented May 21, 2022

Copy link
Copy Markdown
Member

Thank you @varunsh-coder

varunsh-coder mentioned this pull request Jul 28, 2022
Open
32 tasks

ezio-melotti commented Oct 8, 2022

Copy link
Copy Markdown
Member

@ewdurbin, any reason not to backport this PR to 3.11/3.10?

ezio-melotti mentioned this pull request Oct 9, 2022
Merged

ewdurbin commented Oct 10, 2022

Copy link
Copy Markdown
Member

@ezio-melotti not that I'm aware of unless the workflows do not exist.

ezio-melotti added needs backport to 3.10 only security fixes needs backport to 3.11 only security fixes labels Oct 10, 2022

miss-islington commented Oct 10, 2022

Copy link
Copy Markdown
Contributor

Thanks @varunsh-coder for the PR, and @ewdurbin for merging it 🌮🎉.. I'm working now to backport this PR to: 3.11.
🐍🍒⛏🤖

miss-islington commented Oct 10, 2022

Copy link
Copy Markdown
Contributor

Thanks @varunsh-coder for the PR, and @ewdurbin for merging it 🌮🎉.. I'm working now to backport this PR to: 3.10.
🐍🍒⛏🤖

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Oct 10, 2022
ci: add GitHub token permissions (pythonGH-92999)
5ad81c0 
(cherry picked from commit b96e20c)

Co-authored-by: Varun Sharma <varunsh@stepsecurity.io>
bedevere-bot removed the needs backport to 3.11 only security fixes label Oct 10, 2022

miss-islington commented Oct 10, 2022

Copy link
Copy Markdown
Contributor

Sorry, @varunsh-coder and @ewdurbin, I could not cleanly backport this to 3.10 due to a conflict.
Please backport using cherry_picker on command line.
cherry_picker b96e20c1d9be4e6d5ea3e48c9c97e5ecd02f6055 3.10

bedevere-bot commented Oct 10, 2022

Copy link
Copy Markdown

GH-98160 is a backport of this pull request to the 3.11 branch.

bedevere-bot commented Oct 10, 2022

Copy link
Copy Markdown

GH-98161 is a backport of this pull request to the 3.10 branch.

bedevere-bot removed the needs backport to 3.10 only security fixes label Oct 10, 2022
ezio-melotti mentioned this pull request Oct 10, 2022
Closed
miss-islington added a commit that referenced this pull request Oct 10, 2022
ci: add GitHub token permissions (GH-92999)
1269297 
(cherry picked from commit b96e20c)

Co-authored-by: Varun Sharma <varunsh@stepsecurity.io>
ezio-melotti added a commit that referenced this pull request Oct 10, 2022
[3.10] ci: add GitHub token permissions (GH-92999) (#98161)
64ce2cb 
* ci: add GitHub token permissions (#92999)

(cherry picked from commit b96e20c)

* [3.10] ci: add GitHub token permissions (GH-92999).
(cherry picked from commit b96e20c)

Co-authored-by: Varun Sharma <varunsh@stepsecurity.io>

Co-authored-by: Varun Sharma <varunsh@stepsecurity.io>
pnacht mentioned this pull request Nov 21, 2022
Closed
ashishkurmi mentioned this pull request Dec 21, 2022
Open
87 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Show hidden characters
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

ewdurbin ewdurbin approved these changes
zware Awaiting requested review from zware

Assignees

ewdurbin

Labels

skip issue skip news

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

6 participants

Back | FazBrowse Home | New Git URL