From fd15939ae843b91592854b7aacefa516d6c0f72c Mon Sep 17 00:00:00 2001 From: Ivan Dyachkov Date: Thu, 12 Oct 2023 08:41:50 +0200 Subject: [PATCH] chore(ci): limit token scope in workflows --- .github/workflows/build_and_push_docker_images.yaml | 3 +++ .github/workflows/build_docker_for_test.yaml | 3 +++ .github/workflows/check_deps_integrity.yaml | 3 +++ .github/workflows/codeql.yaml | 4 +++- .github/workflows/green_master.yaml | 3 +++ .github/workflows/performance_test.yaml | 3 +++ .github/workflows/release.yaml | 5 +++++ .github/workflows/run_conf_tests.yaml | 3 +++ .github/workflows/run_docker_tests.yaml | 3 +++ .github/workflows/run_emqx_app_tests.yaml | 3 +++ .github/workflows/run_helm_tests.yaml | 3 +++ .github/workflows/run_relup_tests.yaml | 3 +++ .github/workflows/spellcheck.yaml | 3 +++ .github/workflows/stale.yaml | 3 +++ .github/workflows/static_checks.yaml | 3 +++ 15 files changed, 47 insertions(+), 1 deletion(-) diff --git a/.github/workflows/build_and_push_docker_images.yaml b/.github/workflows/build_and_push_docker_images.yaml index 62399575c6..ea67ffbf5f 100644 --- a/.github/workflows/build_and_push_docker_images.yaml +++ b/.github/workflows/build_and_push_docker_images.yaml @@ -75,6 +75,9 @@ on: type: string default: '["self-hosted","ephemeral", "linux"]' +permissions: + contents: read + jobs: docker: runs-on: ${{ fromJSON(inputs.runner_labels) }} diff --git a/.github/workflows/build_docker_for_test.yaml b/.github/workflows/build_docker_for_test.yaml index a71bb96d97..3983f3fa95 100644 --- a/.github/workflows/build_docker_for_test.yaml +++ b/.github/workflows/build_docker_for_test.yaml @@ -23,6 +23,9 @@ on: required: true type: string +permissions: + contents: read + jobs: docker: runs-on: ${{ fromJSON(inputs.runner_labels) }} diff --git a/.github/workflows/check_deps_integrity.yaml b/.github/workflows/check_deps_integrity.yaml index 1b260fae90..df7170523c 100644 --- a/.github/workflows/check_deps_integrity.yaml +++ b/.github/workflows/check_deps_integrity.yaml @@ -10,6 +10,9 @@ on: required: true type: string +permissions: + contents: read + jobs: check_deps_integrity: runs-on: ${{ fromJSON(inputs.runner_labels) }} diff --git a/.github/workflows/codeql.yaml b/.github/workflows/codeql.yaml index a0b701d173..7e2057e30b 100644 --- a/.github/workflows/codeql.yaml +++ b/.github/workflows/codeql.yaml @@ -8,6 +8,9 @@ on: ref: required: false +permissions: + contents: read + jobs: analyze: name: Analyze @@ -15,7 +18,6 @@ jobs: timeout-minutes: 360 permissions: actions: read - contents: read security-events: write container: image: ghcr.io/emqx/emqx-builder/5.1-4:1.14.5-25.3.2-2-ubuntu22.04 diff --git a/.github/workflows/green_master.yaml b/.github/workflows/green_master.yaml index d7d4517d3f..de343a8f95 100644 --- a/.github/workflows/green_master.yaml +++ b/.github/workflows/green_master.yaml @@ -8,6 +8,9 @@ on: - cron: "0 * * * *" workflow_dispatch: +permissions: + contents: read + jobs: rerun-failed-jobs: if: github.repository_owner == 'emqx' diff --git a/.github/workflows/performance_test.yaml b/.github/workflows/performance_test.yaml index 224cfb0b3c..5c938481ef 100644 --- a/.github/workflows/performance_test.yaml +++ b/.github/workflows/performance_test.yaml @@ -19,6 +19,9 @@ env: TF_VAR_prometheus_remote_write_url: ${{ secrets.TF_EMQX_PERF_TEST_PROMETHEUS_REMOTE_WRITE_URL }} SLACK_WEBHOOK_URL: ${{ secrets.TF_EMQX_PERF_TEST_SLACK_URL }} +permissions: + contents: read + jobs: prepare: runs-on: ubuntu-latest diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index ab145a764e..b23f911288 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -13,9 +13,14 @@ on: required: true default: false +permissions: + contents: read + jobs: upload: runs-on: ubuntu-22.04 + permissions: + packages: write strategy: fail-fast: false steps: diff --git a/.github/workflows/run_conf_tests.yaml b/.github/workflows/run_conf_tests.yaml index a69746d76f..e218ae8385 100644 --- a/.github/workflows/run_conf_tests.yaml +++ b/.github/workflows/run_conf_tests.yaml @@ -14,6 +14,9 @@ on: required: true type: string +permissions: + contents: read + jobs: run_conf_tests: runs-on: ${{ fromJSON(inputs.runner_labels) }} diff --git a/.github/workflows/run_docker_tests.yaml b/.github/workflows/run_docker_tests.yaml index 18dd9ac387..08391611fb 100644 --- a/.github/workflows/run_docker_tests.yaml +++ b/.github/workflows/run_docker_tests.yaml @@ -17,6 +17,9 @@ on: required: true type: string +permissions: + contents: read + jobs: basic-tests: runs-on: ${{ fromJSON(inputs.runner_labels) }} diff --git a/.github/workflows/run_emqx_app_tests.yaml b/.github/workflows/run_emqx_app_tests.yaml index c5554805a2..695ad4750a 100644 --- a/.github/workflows/run_emqx_app_tests.yaml +++ b/.github/workflows/run_emqx_app_tests.yaml @@ -26,6 +26,9 @@ on: env: IS_CI: "yes" +permissions: + contents: read + jobs: run_emqx_app_tests: runs-on: ${{ fromJSON(inputs.runner_labels) }} diff --git a/.github/workflows/run_helm_tests.yaml b/.github/workflows/run_helm_tests.yaml index 9c314afde1..c8f46948c0 100644 --- a/.github/workflows/run_helm_tests.yaml +++ b/.github/workflows/run_helm_tests.yaml @@ -17,6 +17,9 @@ on: required: true type: string +permissions: + contents: read + jobs: helm_test: runs-on: ${{ fromJSON(inputs.runner_labels) }} diff --git a/.github/workflows/run_relup_tests.yaml b/.github/workflows/run_relup_tests.yaml index a38ccae4f6..b110e85127 100644 --- a/.github/workflows/run_relup_tests.yaml +++ b/.github/workflows/run_relup_tests.yaml @@ -14,6 +14,9 @@ on: required: true type: string +permissions: + contents: read + jobs: relup_test_plan: runs-on: ["${{ inputs.runner }}", 'linux', 'x64', 'ephemeral'] diff --git a/.github/workflows/spellcheck.yaml b/.github/workflows/spellcheck.yaml index 08f6c2c38d..57e6ac2147 100644 --- a/.github/workflows/spellcheck.yaml +++ b/.github/workflows/spellcheck.yaml @@ -11,6 +11,9 @@ on: required: true type: string +permissions: + contents: read + jobs: spellcheck: strategy: diff --git a/.github/workflows/stale.yaml b/.github/workflows/stale.yaml index eb8038dccd..d26ae79c22 100644 --- a/.github/workflows/stale.yaml +++ b/.github/workflows/stale.yaml @@ -8,6 +8,9 @@ on: - cron: "0 * * * *" workflow_dispatch: +permissions: + contents: read + jobs: stale: if: github.repository_owner == 'emqx' diff --git a/.github/workflows/static_checks.yaml b/.github/workflows/static_checks.yaml index 758c3712b7..7014c33654 100644 --- a/.github/workflows/static_checks.yaml +++ b/.github/workflows/static_checks.yaml @@ -20,6 +20,9 @@ on: env: IS_CI: "yes" +permissions: + contents: read + jobs: static_checks: runs-on: ${{ fromJSON(inputs.runner_labels) }}