Skip to content

Improve OSSF Scorecard Token-Permissions check by tightening GitHub Actions permissions #7090

@gaganhr94

Description

@gaganhr94
{
      "name": "Token-Permissions",
      "score": 0,
      "reason": "detected GitHub workflow tokens with excessive permissions",
      "details": [
        "Warn: no topLevel permission defined: .github/workflows/deploy.yml:1",
        "Warn: no topLevel permission defined: .github/workflows/freshen-images.yml:1",
        "Warn: no topLevel permission defined: .github/workflows/integration.yml:1",
        "Warn: no topLevel permission defined: .github/workflows/olm-check.yml:1",
        "Warn: no topLevel permission defined: .github/workflows/rerun.yml:1",
        "Warn: no topLevel permission defined: .github/workflows/test-go.yml:1",
        "Warn: no topLevel permission defined: .github/workflows/test-helm.yml:1",
        "Warn: no topLevel permission defined: .github/workflows/test-sample-go.yml:1",
        "Warn: no topLevel permission defined: .github/workflows/test-sanity.yml:1",
        "Info: no jobLevel write permissions found"
      ],
}

Several top level permissions are missing, as a result of which the score is low for this particular check of the OpenSSF scorecard. This score can go to 10 if all the top level permissions are set to content: read (i.e, minimal permissions at the top level)

More details on this check:
https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions