ci: set top-level permissions for antithesis-verify workflow#21470
ci: set top-level permissions for antithesis-verify workflow#21470gaganhr94 wants to merge 1 commit intoetcd-io:mainfrom
Conversation
Add explicit `permissions: contents: read` at the workflow level to restrict the default GITHUB_TOKEN to read-only access, following the principle of least privilege. This addresses the OpenSSF Scorecard Token-Permissions warning for .github/workflows/antithesis-verify.yml. Signed-off-by: Gagan H R <hrgagan4@gmail.com>
|
Hi @gaganhr94. Thanks for your PR. I'm waiting for a etcd-io member to verify that this patch is reasonable to test. If it is, they should reply with Regular contributors should join the org to skip this step. Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
k8s-ci-robot
added
the
github_actions
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: gaganhr94 The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
/ok-to-test |
|
@gaganhr94: Cannot trigger testing until a trusted user reviews the PR and leaves an DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
/assign @ivanvc |
3 participants
Summary
Add explicit
permissions: contents: readat the workflow level in.github/workflows/antithesis-verify.ymlto restrict the defaultGITHUB_TOKENto read-only access, following the principle of least privilege.Fixes #21469
Changes
permissions: contents: readto theantithesis-verify.ymlworkflowWhy
The OpenSSF Scorecard
Token-Permissionscheck flagged this workflow for not defining top-level permissions:This change improves the repository's OpenSSF Scorecard score with no functional impact, as the workflow only checks out code and runs local Docker builds.