{
"name": "Token-Permissions",
"score": 0,
"reason": "detected GitHub workflow tokens with excessive permissions",
"details": [
"Warn: no topLevel permission defined: .github/workflows/deploy.yml:1",
"Warn: no topLevel permission defined: .github/workflows/freshen-images.yml:1",
"Warn: no topLevel permission defined: .github/workflows/integration.yml:1",
"Warn: no topLevel permission defined: .github/workflows/olm-check.yml:1",
"Warn: no topLevel permission defined: .github/workflows/rerun.yml:1",
"Warn: no topLevel permission defined: .github/workflows/test-go.yml:1",
"Warn: no topLevel permission defined: .github/workflows/test-helm.yml:1",
"Warn: no topLevel permission defined: .github/workflows/test-sample-go.yml:1",
"Warn: no topLevel permission defined: .github/workflows/test-sanity.yml:1",
"Info: no jobLevel write permissions found"
],
}
Several top level permissions are missing, as a result of which the score is low for this particular check of the OpenSSF scorecard. This score can go to 10 if all the top level permissions are set to content: read (i.e, minimal permissions at the top level)
Several top level permissions are missing, as a result of which the score is low for this particular check of the OpenSSF scorecard. This score can go to 10 if all the top level permissions are set to
content: read(i.e, minimal permissions at the top level)More details on this check:
https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions