From 90beb3f4c45c994b58dd3ea76d4e9bdec794232a Mon Sep 17 00:00:00 2001 From: Alex Date: Mon, 10 Oct 2022 03:52:14 +0300 Subject: [PATCH] GitHub Workflows security hardening (#31057) * build: harden pr-auto-fix.yaml permissions Signed-off-by: Alex * build: harden pr-auto-tag.yaml permissions Signed-off-by: Alex --- .github/workflows/pr-auto-fix.yaml | 6 ++++++ .github/workflows/pr-auto-tag.yaml | 7 +++++++ 2 files changed, 13 insertions(+) diff --git a/.github/workflows/pr-auto-fix.yaml b/.github/workflows/pr-auto-fix.yaml index f61ee7b26ab..712eeb12f43 100644 --- a/.github/workflows/pr-auto-fix.yaml +++ b/.github/workflows/pr-auto-fix.yaml @@ -1,7 +1,13 @@ name: PR AutoFix on: [push] +permissions: {} jobs: PRAutoFix: + permissions: + actions: write # to cancel/stop running workflows (styfle/cancel-workflow-action) + contents: write # to create branch (peter-evans/create-pull-request) + pull-requests: write # to create a PR (peter-evans/create-pull-request) + runs-on: ubuntu-latest steps: # Cache bazel build diff --git a/.github/workflows/pr-auto-tag.yaml b/.github/workflows/pr-auto-tag.yaml index 22041f6f1b7..dac7b2d438b 100644 --- a/.github/workflows/pr-auto-tag.yaml +++ b/.github/workflows/pr-auto-tag.yaml @@ -2,8 +2,15 @@ name: PR AutoTag on: pull_request_target: types: [opened, reopened, synchronized, edited] +permissions: + contents: read # to determine modified files (actions/labeler) + jobs: triage: + permissions: + contents: read # to determine modified files (actions/labeler) + pull-requests: write # to add labels to PRs (actions/labeler) + runs-on: ubuntu-latest steps: - uses: actions/labeler@v3