Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Set permissions for workflows to follow a good security practice. #300

Merged
merged 24 commits into from
Sep 28, 2022
Merged

Set permissions for workflows to follow a good security practice. #300

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
24 commits
Select commit Hold shift + click to select a range
73695be
Set permissions for workflows to follow a good security practice.
nilsreichardt Sep 28, 2022
1762814
Set everywhere write
nilsreichardt Sep 28, 2022
11b3e46
Try with `contents: read`
nilsreichardt Sep 28, 2022
0cef015
Re-trigger CI
nilsreichardt Sep 28, 2022
c8d1adf
Add `actions: read`
nilsreichardt Sep 28, 2022
2bf687f
Set `actions`, `id-token`, `checks` and `deployments` to true
nilsreichardt Sep 28, 2022
eaefd8c
Re-Trigger CI
nilsreichardt Sep 28, 2022
2b1afa3
Remove ID token
nilsreichardt Sep 28, 2022
138bdda
Add `statuses`, `repository-projects` and `discussions`
nilsreichardt Sep 28, 2022
72712f9
Add all remaining permissions
nilsreichardt Sep 28, 2022
c0638ee
Use `id-token: write`
nilsreichardt Sep 28, 2022
aed5503
Change everything to write
nilsreichardt Sep 28, 2022
983d033
Comment out a few permissions
nilsreichardt Sep 28, 2022
97fb87f
Comment out more stuff
nilsreichardt Sep 28, 2022
cfc91b6
Enable actions & checks
nilsreichardt Sep 28, 2022
724e9a8
Comment our `checks`
nilsreichardt Sep 28, 2022
4cbe9d7
Without `contents`
nilsreichardt Sep 28, 2022
070ac86
Add comment
nilsreichardt Sep 28, 2022
02cec03
Re-trigger CI
nilsreichardt Sep 28, 2022
5fed24a
Update .github/workflows/main.yml
nilsreichardt Sep 28, 2022
fbf840f
Update .github/workflows/alpha.yml
nilsreichardt Sep 28, 2022
3a57091
add comment for `checks`
nilsreichardt Sep 28, 2022
83d365e
Update .github/workflows/main.yml
nilsreichardt Sep 28, 2022
fd425c8
Merge branch 'main' into set-github-action-defualt-permission
nilsreichardt Sep 28, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions .github/workflows/alpha.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,11 @@ on:
env:
CI_CD_DART_SCRIPTS_PACKAGE_PATH: "tools/sz_repo_cli/"

# Set permissions to none.
#
# Using the broad default permissions is considered a bad security practice
# and would cause alerts from our scanning tools.
permissions: {}
jobs:
deploy-alpha-web-app:
runs-on: ubuntu-latest
Expand Down
13 changes: 11 additions & 2 deletions .github/workflows/main.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,12 @@ on:
env:
CI_CD_DART_SCRIPTS_PACKAGE_PATH: "tools/sz_repo_cli/"

# Set permissions to none.
#
# Using the broad default permissions is considered a bad security practice
# and would cause alerts from our scanning tools.
permissions: {}

# A workflow run is made up of one or more jobs that can run sequentially or in parallel
jobs:
analyze:
Expand Down Expand Up @@ -154,6 +160,9 @@ jobs:
# 4. Adjust website restrictions for Firebase Key "Sharezone Web Key".
web-preview:
runs-on: ubuntu-latest
permissions:
pull-requests: write # for FirebaseExtended/action-hosting-deploy to comment on PRs
checks: write # for FirebaseExtended/action-hosting-deploy to comment on PRs (without write permissions for checks the action doesn't post a comment to the PR, we don't know why)
steps:
- uses: actions/checkout@v2

Expand All @@ -172,8 +181,8 @@ jobs:
- name: Deploy to Firebase Hosting (sharezone-debug)
uses: FirebaseExtended/action-hosting-deploy@v0
with:
repoToken: '${{ secrets.GITHUB_TOKEN }}'
firebaseServiceAccount: '${{ secrets.FIREBASE_SERVICE_ACCOUNT_SHAREZONE_DEBUG }}'
repoToken: ${{ secrets.GITHUB_TOKEN }}
firebaseServiceAccount: ${{ secrets.FIREBASE_SERVICE_ACCOUNT_SHAREZONE_DEBUG }}
projectId: sharezone-debug
entryPoint: "./app"
expires: '7d'
Expand Down