Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore: Set permissions for GitHub actions #3849

Merged
merged 1 commit into from
May 14, 2022

Conversation

nathannaveen
Copy link
Contributor

 Restrict the GitHub token permissions only to the required ones; this way, even if the attackers will succeed in compromising your workflow, they won’t be able to do much.

- Included permissions for the action. https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions

https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions

https://docs.github.com/en/actions/using-jobs/assigning-permissions-to-jobs

[Keeping your GitHub Actions and workflows secure Part 1: Preventing pwn requests](https://securitylab.github.com/research/github-actions-preventing-pwn-requests/)

Signed-off-by: nathannaveen <42319948+nathannaveen@users.noreply.github.com>
@dgibbs64 dgibbs64 added this to the v22.1.0 milestone Apr 28, 2022
@dgibbs64 dgibbs64 enabled auto-merge (squash) April 28, 2022 13:00
@johnoclockdk johnoclockdk requested a review from dgibbs64 May 1, 2022 21:17
@nathannaveen
Copy link
Contributor Author

@dgibbs64 please let me know if you need anything else to merge this in. Thanks!

@dgibbs64 dgibbs64 changed the base branch from master to develop May 14, 2022 23:21
@dgibbs64 dgibbs64 disabled auto-merge May 14, 2022 23:21
@dgibbs64 dgibbs64 merged commit 20eb96e into GameServerManagers:develop May 14, 2022
@github-actions
Copy link
Contributor

This pull request has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.

@github-actions github-actions bot locked as resolved and limited conversation to collaborators May 15, 2023
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants