From 9dc5aacccbd5ffdb154df3a1db172736cca36145 Mon Sep 17 00:00:00 2001 From: Kyle Harding Date: Mon, 11 Nov 2024 10:19:29 -0500 Subject: [PATCH] Set explicit permissions at the job level This is the more secure approach that defaults to lowest possible permissions. Change-type: patch Signed-off-by: Kyle Harding --- .github/workflows/yocto-build-deploy.yml | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/.github/workflows/yocto-build-deploy.yml b/.github/workflows/yocto-build-deploy.yml index 796015c3c..59f2233fd 100644 --- a/.github/workflows/yocto-build-deploy.yml +++ b/.github/workflows/yocto-build-deploy.yml @@ -171,10 +171,7 @@ env: # https://docs.github.com/en/actions/security-guides/automatic-token-authentication # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions # https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect#adding-permissions-settings -permissions: - id-token: write # This is required for requesting the JWT #https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services#requesting-the-access-token - actions: read # We are fetching workflow run results of a merge commit when workflow is triggered by new tag, to see if tests pass - pull-requests: write # Read is required to fetch the PR that merged, in order to get the test results. Write is required to create PR comments for workflow approvals. +permissions: {} jobs: build: @@ -182,6 +179,14 @@ jobs: runs-on: ${{ fromJSON(inputs.build-runs-on) }} environment: ${{ inputs.deploy-environment }} + # https://docs.github.com/en/actions/security-guides/automatic-token-authentication + # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions + # https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect#adding-permissions-settings + permissions: + id-token: write # This is required for requesting the JWT #https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services#requesting-the-access-token + actions: read # We are fetching workflow run results of a merge commit when workflow is triggered by new tag, to see if tests pass + pull-requests: write # Read is required to fetch the PR that merged, in order to get the test results. Write is required to create PR comments for workflow approvals. + env: automation_dir: "${{ github.workspace }}/balena-yocto-scripts/automation" BALENARC_BALENA_URL: ${{ vars.BALENA_HOST || inputs.deploy-environment || 'balena-cloud.com' }}