Fix "label-pr" workflow for PR from forks #297
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Visit the preview URL for this PR (updated for commit 6195340): https://sharezone-test--pr297-fix-label-pr-for-for-8665qa3m.web.app (expires Wed, 05 Oct 2022 08:00:37 GMT) 🔥 via Firebase Hosting GitHub Action 🌎 |
Jonas-Sander
requested changes
Sep 27, 2022
| # | ||
| # Having workflows without default permissions is considered a bad security | ||
| # practice and it is causing alerts from our scanning tools. | ||
| permissions: read-all |
There was a problem hiding this comment.
Wouldn't it be better to only grant the permissions that the action actually needs?
There was a problem hiding this comment.
Because the repository is public, I don't think you can not read with the GITHUB_TOKEN things that are not already public. But I changed it to permissions: {} which disables all permission and it still works 👍
Jonas-Sander
approved these changes
Sep 27, 2022
Comment on lines
25
to
26
| # Having workflows without default permissions is considered a bad security | ||
| # practice and it is causing alerts from our scanning tools. |
There was a problem hiding this comment.
Suggested change
| # Having workflows without default permissions is considered a bad security | |
| # practice and it is causing alerts from our scanning tools. | |
| # Having workflows with default permissions is considered a bad security | |
| # practice and it is causing alerts from our scanning tools. |
Shouldn't it be this?
There was a problem hiding this comment.
It means the default permission in workflow. In this case
permissions: {}
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Tested it manually (by using
pull_request): https://github.com/SharezoneApp/sharezone-app/actions/runs/3136587111/jobs/5093688752The workflow is not running for this PR because it's not on our
mainbranch. It will be used when this PR has been merged.Closes #294