make GitHub workflow permissions explicit #1692
Conversation
|
Please add more context in the description of this PR, such as links to GitHub documentation about the permissions settings in the workflow file. |
dolmen
added
help wanted
internal/testing
| permissions: | ||
| contents: read | ||
| packages: read | ||
|
|
There was a problem hiding this comment.
I'm not sure this really changes the permissions from the default.
This document says that the default permissions are contents: read, packages: read ... if we are in restricted mode (but I don't know if that is the case).
But I'm not sure we even need both.
|
@cedricvanrompay-datadog Please fix this: #1692 (comment) |
There was a problem hiding this comment.
The setup-go action recommends contents: read permission. No mention of packages: read.
The checkout action also recommends contents: read permission. No mention of packages: read.
So I don't see a reason to grant packages: read.
Summary
make GitHub workflow permissions explicit
Changes
Add a top-level
permissionsfield in each GitHub workflow file.Note that this should not lead to any changes in the permissions workflows currently have because the permissions written mirror the default permissions or are overwritten by job-level permissions
Motivation
It makes workflow permissions easier to read and understand, and it makes some scanner happy like OSSF Scorecard: https://deps.dev/project/github/stretchr%2Ftestify
Related issues
None.