Set minimum permissions for workflows
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 45/100
Research direction
Start by reviewing the workflows under .github/workflows, including ci-java7.yaml around line 42, and compare their actions with the GitHub Actions permissions documentation linked in the issue. Identify the minimum permissions each workflow needs, then verify that workflows using actions/checkout retain the required read access and that all workflow files follow the intended restriction.
Written by the indexing model from the issue text.
Description
Thanks for stopping by to let us know something could be better!
PLEASE READ: If you have a support contract with Google, please create an issue in the support console instead of filing on GitHub. This will ensure a timely response.
Is your feature request related to a problem? Please describe.
GitHub workflows are granted high permissions by default. Permissions that allow, for example, to delete your source code and publish releases. The permissions can be exploited by malicious actions run in the workflow or malicious PRs if run on pull_request_target. This is specially important when using 3P actions such as:
https://github.com/googleapis/google-http-java-client/blob/1acedf75368f11ab03e5f84dd2c58a8a8a662d41/.github/workflows/ci-java7.yaml#L42.
Describe the solution you'd like
Set restricted permissions to run GitHub workflows or declare minimum permissions in the workflows.
e.g. permissions: contents: read for workflows that only need to do actions/checkout.
Describe alternatives you've considered
None.
Additional context
My name is Gabriela and I work on behalf of Google and the OpenSSF suggesting supply-chain security changes.
- Dominant language
- Java
- Stars
- 1.4k
- Forks
- 476
- Avg merge
- 10h 47m
- Merged PRs (30d)
- 3
Getting set up
- No Dockerfile or Docker Compose file
- Has a pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from googleapis/google-http-java-client
-
Core: Validate header names and values to prevent CRLF injectionPossibly taken @insaf021 claimed this 106 days ago. Openpriority: p3
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
Core: XmlPullParser processes external DTD entities (XXE) — disable FEATURE_PROCESS_DOCDECL in Xml#createParser()Possibly taken @insaf021 claimed this 106 days ago. Openpriority: p3
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
-
Core: LowLevelHttpResponse not disconnected when HttpResponse construction throws RuntimeExceptionPossibly taken @insaf021 claimed this 106 days ago. Openpriority: p3
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
-
type: cleanup
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
-
org.apache.http.conn.ssl.SSLSocketFactory is deprecatedMay be free again A pull request for this issue was closed without being merged. Openpriority: p2 type: cleanup
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
All issues in googleapis/google-http-java-client
Similar issues
-
Difficulty 1/5 Under an hour Newbie friendliness 88/100
-
Difficulty 2/5 Under an hour Newbie friendliness 84/100
cpp-best-practices/project_validator#251 ·
Maintainers usually reply within 1 day
-
backend enhancement
Difficulty 2/5 Half a day Newbie friendliness 70/100
damodharg6/payledger#16 ·
-
[Bug]: An initiative list with no current entry logs an error on every changePossibly taken @dwizard0 claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
Maintainers usually reply within 1 day
-
Difficulty 1/5 Under an hour Newbie friendliness 85/100
Maintainers usually reply within 1 day