Skip to content

ci: add GitHub token permissions - #92999

Merged
ewdurbin merged 1 commit into
python:mainfrom
varunsh-coder:token-perms
May 21, 2022
Merged

ci: add GitHub token permissions#92999
ewdurbin merged 1 commit into
python:mainfrom
varunsh-coder:token-perms

Conversation

@varunsh-coder

@varunsh-codervarunsh-coder commented May 20, 2022

Copy link
Copy Markdown
Contributor

GitHub asks developers to define workflow permissions, see https://github.blog/changelog/2021-04-20-github-actions-control-permissions-for-github_token/ and https://docs.github.com/en/actions/security-guides/automatic-token-authentication#modifying-the-permissions-for-the-github_token for securing GitHub workflows against supply-chain attacks.

The Open Source Security Foundation (OpenSSF) Scorecards also treats not setting token permissions as a high-risk issue.

This PR adds minimum token permissions for the GITHUB_TOKEN using https://github.com/step-security/secure-workflows.

This project is part of the top 100 critical projects as per OpenSSF (https://github.com/ossf/wg-securing-critical-projects), so fixing the token permissions to improve security.

@ghost

ghost commented May 20, 2022•
edited by ghost
Loading

Copy link
Copy Markdown

All commit authors signed the Contributor License Agreement.
CLA signed

@bedevere-bot

bedevere-bot commented May 20, 2022

Copy link
Copy Markdown

Most changes to Python require a NEWS entry.

Please add it using the blurb_it web app or the blurb command-line tool.

@varunsh-codervarunsh-coder mentioned this pull request May 20, 2022
Open
@ewdurbinewdurbin mentioned this pull request May 21, 2022
Merged
@ewdurbin
ewdurbin merged commit b96e20c into python:mainMay 21, 2022
@ewdurbin

ewdurbin commented May 21, 2022

Copy link
Copy Markdown
Member

Thank you @varunsh-coder

@varunsh-codervarunsh-coder mentioned this pull request Jul 28, 2022
Open
32 tasks
@ezio-melotti

ezio-melotti commented Oct 8, 2022

Copy link
Copy Markdown
Member

@ewdurbin, any reason not to backport this PR to 3.11/3.10?

@ezio-melottiezio-melotti mentioned this pull request Oct 9, 2022
Merged
@ewdurbin

ewdurbin commented Oct 10, 2022

Copy link
Copy Markdown
Member

@ezio-melotti not that I'm aware of unless the workflows do not exist.

@ezio-melottiezio-melotti added needs backport to 3.10 only security fixes needs backport to 3.11 only security fixes labels Oct 10, 2022
@miss-islington

miss-islington commented Oct 10, 2022

Copy link
Copy Markdown
Contributor

Thanks @varunsh-coder for the PR, and @ewdurbin for merging it 🌮🎉.. I'm working now to backport this PR to: 3.11.
🐍🍒⛏🤖

@miss-islington

miss-islington commented Oct 10, 2022

Copy link
Copy Markdown
Contributor

Thanks @varunsh-coder for the PR, and @ewdurbin for merging it 🌮🎉.. I'm working now to backport this PR to: 3.10.
🐍🍒⛏🤖

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Oct 10, 2022
@varunsh-coder@miss-islington
ci: add GitHub token permissions (pythonGH-92999)
5ad81c0
(cherry picked from commit b96e20c)
Co-authored-by: Varun Sharma <varunsh@stepsecurity.io>
@bedevere-botbedevere-bot removed the needs backport to 3.11 only security fixes label Oct 10, 2022
@miss-islington

miss-islington commented Oct 10, 2022

Copy link
Copy Markdown
Contributor

Sorry, @varunsh-coder and @ewdurbin, I could not cleanly backport this to 3.10 due to a conflict.
Please backport using cherry_picker on command line.
cherry_picker b96e20c1d9be4e6d5ea3e48c9c97e5ecd02f6055 3.10

@bedevere-bot

bedevere-bot commented Oct 10, 2022

Copy link
Copy Markdown

GH-98160 is a backport of this pull request to the 3.11 branch.

@bedevere-bot

bedevere-bot commented Oct 10, 2022

Copy link
Copy Markdown

GH-98161 is a backport of this pull request to the 3.10 branch.

@bedevere-botbedevere-bot removed the needs backport to 3.10 only security fixes label Oct 10, 2022
@ezio-melottiezio-melotti mentioned this pull request Oct 10, 2022
Closed
miss-islington added a commit that referenced this pull request Oct 10, 2022
@miss-islington@varunsh-coder
ci: add GitHub token permissions (GH-92999)
1269297
(cherry picked from commit b96e20c)
Co-authored-by: Varun Sharma <varunsh@stepsecurity.io>
ezio-melotti added a commit that referenced this pull request Oct 10, 2022
@ezio-melotti@varunsh-coder
[3.10] ci: add GitHub token permissions (GH-92999) (#98161)
64ce2cb
* ci: add GitHub token permissions (#92999)
(cherry picked from commit b96e20c)
* [3.10] ci: add GitHub token permissions (GH-92999).
(cherry picked from commit b96e20c)
Co-authored-by: Varun Sharma <varunsh@stepsecurity.io>
Co-authored-by: Varun Sharma <varunsh@stepsecurity.io>
@pnachtpnacht mentioned this pull request Nov 21, 2022
Closed
@ashishkurmiashishkurmi mentioned this pull request Dec 21, 2022
Open
87 tasks
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ewdurbinewdurbinewdurbin approved these changes
@zwarezwareAwaiting requested review from zware

Assignees

@ewdurbinewdurbin

Labels

skip issueskip news

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

6 participants

@varunsh-coder@bedevere-bot@ewdurbin@ezio-melotti@miss-islington@erlend-aasland