Skip to content

Commit de28b75

Browse files
hubwriterSarah Edwards
hubwriter
and
Sarah Edwards
authored
Configure GITHUB_TOKEN permissions (#18348)
* Add 'permissions' to reference page * Final set of pre-review changes * Update content/actions/learn-github-actions/security-hardening-for-github-actions.md Co-authored-by: Sarah Edwards <skedwards88@github.com> * Update content/actions/reference/authentication-in-a-workflow.md Co-authored-by: Sarah Edwards <skedwards88@github.com> * Update content/actions/reference/authentication-in-a-workflow.md Co-authored-by: Sarah Edwards <skedwards88@github.com> * Update content/actions/reference/authentication-in-a-workflow.md Co-authored-by: Sarah Edwards <skedwards88@github.com> * Update content/actions/reference/authentication-in-a-workflow.md Co-authored-by: Sarah Edwards <skedwards88@github.com> * Update data/reusables/github-actions/workflow-permissions-intro.md Co-authored-by: Sarah Edwards <skedwards88@github.com> * Update content/actions/reference/authentication-in-a-workflow.md Co-authored-by: Sarah Edwards <skedwards88@github.com> * Update content/actions/reference/authentication-in-a-workflow.md Co-authored-by: Sarah Edwards <skedwards88@github.com> * Update data/reusables/github-actions/publish-to-packages-workflow-step.md Co-authored-by: Sarah Edwards <skedwards88@github.com> * Update content/actions/guides/publishing-nodejs-packages.md * Update content/actions/guides/publishing-java-packages-with-gradle.md * Update content/actions/guides/publishing-java-packages-with-maven.md * Update content/actions/guides/publishing-nodejs-packages.md * Update content/actions/reference/authentication-in-a-workflow.md * Update content/actions/reference/authentication-in-a-workflow.md * Update content/actions/reference/authentication-in-a-workflow.md * Update content/actions/reference/authentication-in-a-workflow.md * Update content/actions/learn-github-actions/security-hardening-for-github-actions.md * Update content/actions/reference/authentication-in-a-workflow.md * Update content/actions/reference/workflow-syntax-for-github-actions.md * Update content/actions/reference/workflow-syntax-for-github-actions.md * Update content/actions/reference/workflow-syntax-for-github-actions.md * Update content/github/administering-a-repository/disabling-or-limiting-github-actions-for-a-repository.md * Update content/github/setting-up-and-managing-organizations-and-teams/disabling-or-limiting-github-actions-for-your-organization.md * Update content/github/setting-up-and-managing-your-enterprise/enforcing-github-actions-policies-in-your-enterprise-account.md * Update content/packages/guides/using-github-packages-with-github-actions.md * Make review comment changes (locally) * Resolve conflicts caused by remotely made review changes * Remove translation file changes from PR. * Remove rogue indentation in Important box * Remove sentence about default being set to restricted. This *will* be the case for new repos in future, but that isn't being shipped at the moment. * Add permissions to workflow examples (#18393) Co-authored-by: Sarah Edwards <skedwards88@github.com>
1 parent 317872f commit de28b75

37 files changed

Lines changed: 455 additions & 151 deletions

File tree

‎assets/images/help/settings/actions-workflow-permissions-enterprise.png‎

126 KB
Loading

‎assets/images/help/settings/actions-workflow-permissions-organization.png‎

125 KB
Loading

‎assets/images/help/settings/actions-workflow-permissions-repository.png‎

108 KB
Loading

‎content/actions/guides/adding-labels-to-issues.md‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,6 @@ In the tutorial, you will first make a workflow file that uses the [`andymckay/l
2929
2. {% data reusables.actions.make-workflow-file %}
3030
3. Copy the following YAML contents into your workflow file.
3131

32-
{% raw %}
3332
```yaml{:copy}
3433
name: Label issues
3534
on:
@@ -39,14 +38,16 @@ In the tutorial, you will first make a workflow file that uses the [`andymckay/l
3938
- opened
4039
jobs:
4140
label_issues:
42-
runs-on: ubuntu-latest
41+
runs-on: ubuntu-latest{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@3.1" or currentVersion == "github-ae@next" %}
42+
permissions:
43+
issues: write{% endif %}
4344
steps:
4445
- name: Label issues
4546
uses: andymckay/labeler@1.0.2
4647
with:
4748
add-labels: "triage"
4849
```
49-
{% endraw %}
50+
5051
4. Customize the parameters in your workflow file:
5152
- Change the value for `add-labels` to the list of labels that you want to add to the issue. Separate multiple labels with commas. For example, `"help wanted, good first issue"`. For more information about labels, see "[Managing labels](/github/managing-your-work-on-github/managing-labels#applying-labels-to-issues-and-pull-requests)."
5253
5. {% data reusables.actions.commit-workflow %}

‎content/actions/guides/building-and-testing-net.md‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -227,7 +227,6 @@ jobs:
227227

228228
You can configure your workflow to publish your Dotnet package to a package registry when your CI tests pass. You can use repository secrets to store any tokens or credentials needed to publish your binary. The following example creates and publishes a package to {% data variables.product.prodname_registry %} using `dotnet core cli`.
229229

230-
{% raw %}
231230
```yaml
232231
name: Upload dotnet package
233232
@@ -237,19 +236,21 @@ on:
237236
238237
jobs:
239238
deploy:
240-
runs-on: ubuntu-latest
239+
runs-on: ubuntu-latest{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@3.1" or currentVersion == "github-ae@next" %}
240+
permissions:
241+
packages: write
242+
contents: read{% endif %}
241243
steps:
242244
- uses: actions/checkout@v2
243245
- uses: actions/setup-dotnet@v1
244246
with:
245247
dotnet-version: '3.1.x' # SDK Version to use.
246248
source-url: https://nuget.pkg.github.com/<owner>/index.json
247249
env:
248-
NUGET_AUTH_TOKEN: ${{secrets.GITHUB_TOKEN}}
250+
NUGET_AUTH_TOKEN: {% raw %}${{secrets.GITHUB_TOKEN}}{% endraw %}
249251
- run: dotnet build --configuration Release <my project>
250252
- name: Create the package
251253
run: dotnet pack --configuration Release <my project>
252254
- name: Publish the package to GPR
253255
run: dotnet nuget push <my project>/bin/Release/*.nupkg
254256
```
255-
{% endraw %}

‎content/actions/guides/building-and-testing-ruby.md‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -264,7 +264,6 @@ You can configure your workflow to publish your Ruby package to any package regi
264264

265265
You can store any access tokens or credentials needed to publish your package using repository secrets. The following example creates and publishes a package to `GitHub Package Registry` and `RubyGems`.
266266

267-
{% raw %}
268267
```yaml
269268
270269
name: Ruby Gem
@@ -281,9 +280,12 @@ on:
281280
jobs:
282281
build:
283282
name: Build + Publish
284-
runs-on: ubuntu-latest
283+
runs-on: ubuntu-latest{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@3.1" or currentVersion == "github-ae@next" %}
284+
permissions:
285+
packages: write
286+
contents: read{% endif %}
285287

286-
steps:
288+
steps:{% raw %}
287289
- uses: actions/checkout@v2
288290
- name: Set up Ruby 2.6
289291
uses: ruby/setup-ruby@v1
@@ -312,6 +314,5 @@ jobs:
312314
gem build *.gemspec
313315
gem push *.gem
314316
env:
315-
GEM_HOST_API_KEY: "${{secrets.RUBYGEMS_AUTH_TOKEN}}"
317+
GEM_HOST_API_KEY: "${{secrets.RUBYGEMS_AUTH_TOKEN}}"{% endraw %}
316318
```
317-
{% endraw %}

‎content/actions/guides/closing-inactive-issues.md‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,6 @@ In the tutorial, you will first make a workflow file that uses the [`actions/sta
2929
2. {% data reusables.actions.make-workflow-file %}
3030
3. Copy the following YAML contents into your workflow file.
3131

32-
{% raw %}
3332
```yaml{:copy}
3433
name: Close inactive issues
3534
on:
@@ -38,7 +37,10 @@ In the tutorial, you will first make a workflow file that uses the [`actions/sta
3837
3938
jobs:
4039
close-issues:
41-
runs-on: ubuntu-latest
40+
runs-on: ubuntu-latest{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@3.1" or currentVersion == "github-ae@next" %}
41+
permissions:
42+
issues: write
43+
pull-requests: write{% endif %}
4244
steps:
4345
- uses: actions/stale@v3
4446
with:
@@ -49,9 +51,9 @@ In the tutorial, you will first make a workflow file that uses the [`actions/sta
4951
close-issue-message: "This issue was closed because it has been inactive for 14 days since being marked as stale."
5052
days-before-pr-stale: -1
5153
days-before-pr-close: -1
52-
repo-token: ${{ secrets.GITHUB_TOKEN }}
54+
repo-token: {% raw %}${{ secrets.GITHUB_TOKEN }}{% endraw %}
5355
```
54-
{% endraw %}
56+
5557
4. Customize the parameters in your workflow file:
5658
- Change the value for `on.schedule` to dictate when you want this workflow to run. In the example above, the workflow will run every day at 1:30 UTC. For more information about scheduled workflows, see "[Scheduled events](/actions/reference/events-that-trigger-workflows#scheduled-events)."
5759
- Change the value for `days-before-issue-stale` to the number of days without activity before the `actions/stale` action labels an issue. If you never want this action to label issues, set this value to `-1`.

‎content/actions/guides/commenting-on-an-issue-when-a-label-is-added.md‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,6 @@ In the tutorial, you will first make a workflow file that uses the [`peter-evans
2929
2. {% data reusables.actions.make-workflow-file %}
3030
3. Copy the following YAML contents into your workflow file.
3131

32-
{% raw %}
3332
```yaml{:copy}
3433
name: Add comment
3534
on:
@@ -39,16 +38,18 @@ In the tutorial, you will first make a workflow file that uses the [`peter-evans
3938
jobs:
4039
add-comment:
4140
if: github.event.label.name == 'help-wanted'
42-
runs-on: ubuntu-latest
41+
runs-on: ubuntu-latest{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@3.1" or currentVersion == "github-ae@next" %}
42+
permissions:
43+
issues: write{% endif %}
4344
steps:
4445
- name: Add comment
4546
uses: peter-evans/create-or-update-comment@v1
4647
with:
47-
issue-number: ${{ github.event.issue.number }}
48+
issue-number: {% raw %}${{ github.event.issue.number }}{% endraw %}
4849
body: |
4950
This issue is available for anyone to work on. **Make sure to reference this issue in your pull request.** :sparkles: Thank you for your contribution! :sparkles:
5051
```
51-
{% endraw %}
52+
5253
4. Customize the parameters in your workflow file:
5354
- Replace `help-wanted` in `if: github.event.label.name == 'help-wanted'` with the label that you want to act on. If you want to act on more than one label, separate the conditions with `||`. For example, `if: github.event.label.name == 'bug' || github.event.label.name == 'fix me'` will comment whenever the `bug` or `fix me` labels are added to an issue.
5455
- Change the value for `body` to the comment that you want to add. GitHub flavored markdown is supported. For more information about markdown, see "[Basic writing and formatting syntax](/github/writing-on-github/basic-writing-and-formatting-syntax)."

‎content/actions/guides/deploying-to-amazon-elastic-container-service.md‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -73,7 +73,6 @@ The following example workflow demonstrates how to build a container image and p
7373
7474
Ensure that you provide your own values for all the variables in the `env` key of the workflow.
7575
76-
{% raw %}
7776
```yaml{:copy}
7877
name: Deploy to Amazon ECS
7978
@@ -98,9 +97,12 @@ defaults:
9897
jobs:
9998
deploy:
10099
name: Deploy
101-
runs-on: ubuntu-latest
100+
runs-on: ubuntu-latest{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@3.1" or currentVersion == "github-ae@next" %}
101+
permissions:
102+
packages: write
103+
contents: read{% endif %}
102104
103-
steps:
105+
{% raw %}steps:
104106
- name: Checkout
105107
uses: actions/checkout@v2
106108
@@ -142,9 +144,9 @@ jobs:
142144
task-definition: ${{ steps.task-def.outputs.task-definition }}
143145
service: ${{ env.ECS_SERVICE }}
144146
cluster: ${{ env.ECS_CLUSTER }}
145-
wait-for-service-stability: true
147+
wait-for-service-stability: true{% endraw %}
146148
```
147-
{% endraw %}
149+
148150

149151
### Additional resources
150152

‎content/actions/guides/publishing-docker-images.md‎

Lines changed: 14 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -98,7 +98,6 @@ The `build-push-action` options required for {% data variables.product.prodname_
9898
* `registry`: Must be set to `docker.pkg.github.com`.
9999
* `repository`: Must be set in the format `OWNER/REPOSITORY/IMAGE_NAME`. For example, for an image named `octo-image` stored on {% data variables.product.prodname_dotcom %} at `http://github.com/octo-org/octo-repo`, the `repository` option should be set to `octo-org/octo-repo/octo-image`.
100100

101-
{% raw %}
102101
```yaml{:copy}
103102
name: Publish Docker image
104103
on:
@@ -107,21 +106,23 @@ on:
107106
jobs:
108107
push_to_registry:
109108
name: Push Docker image to GitHub Packages
110-
runs-on: ubuntu-latest
109+
runs-on: ubuntu-latest{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@3.1" or currentVersion == "github-ae@next" %}
110+
permissions:
111+
packages: write
112+
contents: read{% endif %}
111113
steps:
112114
- name: Check out the repo
113115
uses: actions/checkout@v2
114116
- name: Push to GitHub Packages
115117
uses: docker/build-push-action@v1
116118
with:
117-
username: ${{ github.actor }}
118-
password: ${{ secrets.GITHUB_TOKEN }}
119+
username: {% raw %}${{ github.actor }}{% endraw %}
120+
password: {% raw %}${{ secrets.GITHUB_TOKEN }}{% endraw %}
119121
registry: docker.pkg.github.com
120122
repository: my-org/my-repo/my-image
121123
tag_with_ref: true
122124
123125
```
124-
{% endraw %}
125126

126127
{% data reusables.github-actions.docker-tag-with-ref %}
127128

@@ -131,7 +132,6 @@ In a single workflow, you can publish your Docker image to multiple registries b
131132

132133
The following example workflow uses the `build-push-action` steps from the previous sections ("[Publishing images to Docker Hub](#publishing-images-to-docker-hub)" and "[Publishing images to {% data variables.product.prodname_registry %}](#publishing-images-to-github-packages)") to create a single workflow that pushes to both registries.
133134

134-
{% raw %}
135135
```yaml{:copy}
136136
name: Publish Docker image
137137
on:
@@ -140,26 +140,28 @@ on:
140140
jobs:
141141
push_to_registries:
142142
name: Push Docker image to multiple registries
143-
runs-on: ubuntu-latest
143+
runs-on: ubuntu-latest{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@3.1" or currentVersion == "github-ae@next" %}
144+
permissions:
145+
packages: write
146+
contents: read{% endif %}
144147
steps:
145148
- name: Check out the repo
146149
uses: actions/checkout@v2
147150
- name: Push to Docker Hub
148151
uses: docker/build-push-action@v1
149152
with:
150-
username: ${{ secrets.DOCKER_USERNAME }}
151-
password: ${{ secrets.DOCKER_PASSWORD }}
153+
username: {% raw %}${{ secrets.DOCKER_USERNAME }}{% endraw %}
154+
password: {% raw %}${{ secrets.DOCKER_PASSWORD }}{% endraw %}
152155
repository: my-docker-hub-namespace/my-docker-hub-repository
153156
tag_with_ref: true
154157
- name: Push to GitHub Packages
155158
uses: docker/build-push-action@v1
156159
with:
157-
username: ${{ github.actor }}
158-
password: ${{ secrets.GITHUB_TOKEN }}
160+
username: {% raw %}${{ github.actor }}{% endraw %}
161+
password: {% raw %}${{ secrets.GITHUB_TOKEN }}{% endraw %}
159162
registry: docker.pkg.github.com
160163
repository: my-org/my-repo/my-image
161164
tag_with_ref: true
162165
```
163-
{% endraw %}
164166

165167
The above workflow checks out the {% data variables.product.prodname_dotcom %} repository, and uses the `build-push-action` action twice to build and push the Docker image to Docker Hub and {% data variables.product.prodname_registry %}. For both steps, it sets the `build-push-action` option [`tag_with_ref`](https://github.com/marketplace/actions/build-and-push-docker-images#tag_with_ref) to automatically tag the built Docker image with the Git reference of the workflow event. This workflow is triggered on publishing a {% data variables.product.prodname_dotcom %} release, so the reference for both registries will be the Git tag for the release.

0 commit comments

Comments
 (0)