Please define actions workflow permissions

Aberta
  • Algo errado?
#329 0 comentários 0 reações 0 responsáveis Ver no GitHub

Ninguém assumiu esta issue ainda.

Avaliação

Dificuldade
3/5
Tempo estimado
1-2 dias
Facilidade para iniciantes
62/100
Tipo de issue
Funcionalidade
Clareza
Razoavelmente clara
Status de atividade
Estagnada
Stack de tecnologia
github-actions
Domínio
ci-cd, security

Direção de pesquisa

Comece lendo .github/workflows/lighthouse.yml, .github/workflows/nodejs.yml e .github/workflows/publish.yml e, em seguida, faça um inventário dos jobs e das uses entries de cada workflow. Determine as permissões mínimas necessárias para cada workflow, adicione blocos explícitos de menor privilégio preservando a formatação e verifique se a sintaxe YAML e os requisitos dos workflows continuam válidos.

Escrita pelo modelo de indexação a partir do texto da issue.

Descrição

Workflow permissions improvement

There are 3 workflow files that are currently lacking explicit permissions

Affected Workflow Files

The following workflow files need permissions to be explicitly defined:

Request

Ensure permissions are explicitly defined. Below are Copilot prompts/instructions if you would like Copilot's assistance with addressing this.

GitHub Copilot Assignment Prompts and Context

Task: Add explicit permissions to GitHub Actions workflow files that are currently missing them.

Scope: Update the workflow files listed above to include appropriate permissions: blocks.

Analysis Methodology:

  1. Gather Current State: Check if the workflow has any existing permissions defined
  2. Inventory Workflow Actions:
    • Actions performed directly by the workflow
    • API calls made by the workflow
    • External actions included via uses: statements
  3. Determine Required Permissions: Map each action to its minimum required permissions
  4. Synthesize Minimal Permissions: Create permissions block with only necessary permissions

Requirements:

  1. Add a permissions: block to each workflow file that doesn't have one
  2. Start with contents: read as the minimum permission
  3. Add additional permissions only if the workflow actually needs them based on the actions it performs
  4. Place the permissions: block at the job level or workflow level as appropriate
  5. Ensure the syntax is correct and follows YAML formatting
  6. Maintain existing content formatting, including indentation and comments

Files to modify: See the list of affected workflow files above.

Acceptance criteria:

  • All listed workflow files have explicit permissions defined
  • Permissions follow the principle of least privilege
  • YAML syntax is valid
  • Workflows still function correctly after changes

Copilot Instructions:

Please create a pull request that adds appropriate permissions: blocks to each of the workflow files listed above. Analyze each workflow to determine the minimum permissions required based on the actions it performs, and add only those necessary permissions.

Linguagem predominante
TypeScript
Estrelas
1.4k
Forks
61
Merge médio
1d 15h
PRs com merge (30d)
8

Preparar o ambiente

Abrir no Codespaces

Inicia o contêiner de desenvolvimento do projeto no navegador, com a sua própria conta do GitHub.

Primeiros passos

  1. Leia a issue inteira e depois o guia de contribuição do projeto.
  2. Comente na issue dizendo que vai assumir — evita que duas pessoas façam o mesmo trabalho.
  3. Faça um fork do repositório e trabalhe em uma branch.
  4. Abra um pull request que referencie o número da issue.

Mais de github/catalyst

Todas as issues de github/catalyst

Issues semelhantes

Mais issues de TypeScript

Receba novas issues na sua caixa de entrada

Um resumo curto de issues do GitHub para quem está começando.