Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

security: add permissions block to workflows #38047

Merged
merged 3 commits into from
Mar 27, 2024
Merged

security: add permissions block to workflows #38047

merged 3 commits into from
Mar 27, 2024

Conversation

reakaleek
Copy link
Member

Details

⚠️ This PR was created by an automated tool. Please review the changes carefully. ⚠️

We want to set the default permissions for workflows to read-only for contents.
This is a security measure to prevent accidental changes to the repository.

This change adds a top-level permissions block to all workflows in the .github/workflows directory.

permissions:
  contents: read

In some cases workflows might need more permissions than just contents: read.
Please checkout this branch and add the necessary permissions to the workflows.

If your workflow uses a Personal Access Token (PAT), we can still add the permissions block,
but it will not have any effect.

Merging this PR as is might cause workflows that need more permissions to fail.

If there are any questions, please reach out to the @elastic/observablt-ci

@reakaleek reakaleek requested a review from a team as a code owner February 17, 2024 19:09
@reakaleek reakaleek self-assigned this Feb 17, 2024
@reakaleek reakaleek requested review from fearful-symmetry, faec and a team February 17, 2024 19:09
@botelastic botelastic bot added the needs_team Indicates that the issue/PR needs a Team:* label label Feb 17, 2024
@mergify Mergify
Copy link
Contributor

mergify bot commented Feb 17, 2024

This pull request does not have a backport label.
If this is a bug or security fix, could you label this PR @reakaleek? 🙏.
For such, you'll need to label your PR with:

  • The upcoming major version of the Elastic Stack
  • The upcoming minor version of the Elastic Stack (if you're not pushing a breaking change)

To fixup this pull request, you need to add the backport labels for the needed
branches, such as:

  • backport-v8./d.0 is the label to automatically backport to the 8./d branch. /d is the digit

@elasticmachine
Copy link
Collaborator

elasticmachine commented Feb 17, 2024 •
edited
Loading

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS
Pipeline View Test View Changes Artifacts preview preview

Expand to view the summary

Build stats

  • Start Time: 2024-03-26T09:20:42.509+0000

  • Duration: 16 min 54 sec

Test stats 🧪

Test Results
Failed 0
Passed 3
Skipped 0
Total 3

💚 Flaky test report

Tests succeeded.

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

  • /test : Re-trigger the build.

  • /package : Generate the packages and run the E2E tests.

  • /beats-tester : Run the installation tests with beats-tester.

  • run elasticsearch-ci/docs : Re-trigger the docs validation. (use unformatted text in the comment!)

@pierrehilbert pierrehilbert added the Team:Elastic-Agent Label for the Agent team label Feb 19, 2024
@elasticmachine
Copy link
Collaborator

Pinging @elastic/elastic-agent (Team:Elastic-Agent)

@botelastic botelastic bot removed the needs_team Indicates that the issue/PR needs a Team:* label label Feb 19, 2024
@v1v v1v enabled auto-merge (squash) February 20, 2024 11:21
@v1v v1v added backport-7.17 Automated backport to the 7.17 branch with mergify backport-v8.13.0 Automated backport with mergify labels Feb 20, 2024
@v1v
Copy link
Member

v1v commented Mar 7, 2024

@Mergifyio rebase

@v1v v1v force-pushed the gh-oblt/add-permission-block-to-workflows branch from 674e19a to 134ba84 Compare March 7, 2024 17:24
@mergify Mergify
Copy link
Contributor

mergify bot commented Mar 7, 2024

rebase

✅ Branch has been successfully rebased

@elasticmachine
Copy link
Collaborator

💚 Build Succeeded

History

cc @reakaleek

@elasticmachine
Copy link
Collaborator

💚 Build Succeeded

History

cc @reakaleek

@elasticmachine
Copy link
Collaborator

💚 Build Succeeded

History

cc @reakaleek

@elasticmachine
Copy link
Collaborator

💚 Build Succeeded

History

cc @reakaleek

@elasticmachine
Copy link
Collaborator

elasticmachine commented Mar 12, 2024 •
edited
Loading

💔 Build Failed

Failed CI Steps

History

cc @reakaleek

@elasticmachine
Copy link
Collaborator

elasticmachine commented Mar 12, 2024 •
edited
Loading

💔 Build Failed

Failed CI Steps

History

cc @reakaleek

@reakaleek reakaleek requested a review from a team as a code owner March 26, 2024 09:20
dliappis
dliappis approved these changes Mar 27, 2024
View reviewed changes
Copy link
Contributor

@dliappis dliappis left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@v1v v1v merged commit f502623 into main Mar 27, 2024
66 of 68 checks passed
@v1v v1v deleted the gh-oblt/add-permission-block-to-workflows branch March 27, 2024 08:54
mergify bot pushed a commit that referenced this pull request Mar 27, 2024
@reakaleek @mergify
security: add permissions block to workflows (#38047)
0e74b9b 
(cherry picked from commit f502623)
mergify bot pushed a commit that referenced this pull request Mar 27, 2024
@reakaleek @mergify
security: add permissions block to workflows (#38047)
bd3b705 
(cherry picked from commit f502623)

# Conflicts:
#	.github/workflows/platform-ingest-project-board.yml
#	.github/workflows/post-dependabot.yml
This was referenced Mar 27, 2024
Closed
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@v1v v1v v1v approved these changes

@dliappis dliappis dliappis approved these changes

@fearful-symmetry fearful-symmetry Awaiting requested review from fearful-symmetry fearful-symmetry was automatically assigned from elastic/elastic-agent-data-plane

@faec faec Awaiting requested review from faec faec was automatically assigned from elastic/elastic-agent-data-plane

Assignees

@reakaleek reakaleek

Labels
backport-7.17 Automated backport to the 7.17 branch with mergify backport-v8.13.0 Automated backport with mergify Team:Elastic-Agent Label for the Agent team
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
5 participants
@reakaleek @elasticmachine @v1v @dliappis @pierrehilbert