Repository navigation
[sec-check] fix: scope workflow token permissions to job level - #6256
Conversation
…card TokenPermissionsID) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: sec-check <sec-check@hive.kubestellar.io>
kubestellar-prow
Bot
added
the
dco-signoff: yes
✅ Deploy Preview for kubestellar-docs ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
kubestellar-prow
Bot
added
the
size/S
clubanderson
added
security
and removed
dco-signoff: yes
github-actions
Bot
added
ci-cd
yaml
dco-signoff: yes
There was a problem hiding this comment.
Pull request overview
This PR aims to address OSSF Scorecard TokenPermissions alerts by reducing overly broad GITHUB_TOKEN permissions in several GitHub Actions workflows and shifting elevated scopes to explicit job-level permissions: blocks.
Changes:
- Replaces workflow-level permission maps with
permissions: read-allacross multiple workflows. - Adds/updates job-level
permissions:blocks for workflows that require write scopes (e.g., Scorecard uploads, Copilot automation). - Adjusts Copilot DCO workflow to use job-level permissions.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 5 comments.
| File | Description |
|---|---|
| .github/workflows/scorecard.yml | Moves elevated permissions from workflow scope to the analysis job; workflow default set to read-all. |
| .github/workflows/copilot-dco.yml | Sets workflow default to read-all and adds job-level permissions for the reusable DCO workflow. |
| .github/workflows/copilot-automation.yml | Changes workflow-level permissions from contents: read to read-all while keeping job-level write permissions. |
| .github/workflows/ai-fix.yml | Changes workflow-level permissions from contents: read to read-all while keeping job-level write permissions. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| contents: read | ||
| actions: read | ||
| id-token: write | ||
| permissions: read-all |
| pull-requests: read | ||
| statuses: write | ||
| # Minimal default permissions at workflow scope; job permissions are declared explicitly below. | ||
| permissions: read-all |
| contents: read | ||
| pull-requests: write | ||
| statuses: write |
|
|
||
| permissions: | ||
| contents: read | ||
| permissions: read-all |
|
|
||
| permissions: | ||
| contents: read | ||
| permissions: read-all |
|
Thank you for your contribution! Your PR has been merged. Check out what's new:
Stay connected: Slack #kubestellar-dev | Multi-Cluster Survey |
Security Fix
Moves overly-broad workflow-level
permissions:blocks toread-allso the GITHUB_TOKEN defaults to read-only for all jobs. Jobs requiring elevated permissions have explicit job-levelpermissions:blocks.Affected files:
.github/workflows/copilot-automation.yml— workflow-levelcontents: read→read-all.github/workflows/ai-fix.yml— workflow-levelcontents: read→read-all.github/workflows/copilot-dco.yml— workflow-level write permissions →read-all; job-level block added.github/workflows/scorecard.yml— workflow-level write permissions →read-all; job-level permissions addedCloses Scorecard alerts #47, #46, #45, #43, #6.
Fixes #6255
Filed by sec-check agent (ACMM L6 — full mode)