ci: add read-only token permissions and pin all action references to SHAs#1269
Open
Alb3e3 wants to merge 1 commit into
Open
ci: add read-only token permissions and pin all action references to SHAs#1269Alb3e3 wants to merge 1 commit into
Alb3e3 wants to merge 1 commit into
Conversation
…SHAs All seven CI workflows lacked a top-level permissions block, so they inherited the repository default (potentially write-all). Each workflow now has `permissions: read-all` at the top level. In addition, every action reference that used a mutable version tag was pinned to its full commit SHA, eliminating the supply-chain risk from a tag being silently moved: - actions/checkout@v6 → @df4cb1c (v6.0.3) - actions/checkout@v4 → @11bd719 (v4.2.2) - actions/upload-artifact@v6 → @b7c566a (v6) - msys2/setup-msys2@v2 → @e989830 (v2) - cygwin/cygwin-install-action@master → @781ea34 - vmactions/dragonflybsd-vm@v1 → @4ba8127 - vmactions/freebsd-vm@v1 → @a6de934 - vmactions/netbsd-vm@v1 → @99816dc - vmactions/omnios-vm@v1 → @d42d894 - vmactions/openbsd-vm@v1 → @fcf799d - vmactions/solaris-vm@v1 → @d30dd6c - google/oss-fuzz/.../build_fuzzers@master → @439b356 - google/oss-fuzz/.../run_fuzzers@master → @439b356 Verified with zizmor --min-severity medium: 0 high-severity findings after this patch (down from 26 before). Signed-off-by: Alb3e3 <tomaska.filip@gmail.com>
Alb3e3
force-pushed
the
harden-workflow-permissions
branch
from
6efdf3b to
3927279
Compare
Contributor
|
Pinning to specific commit SHA is a no-go and doesn't magically fix all potential security issues in third-party actions. Most security-related bots actually prefer to pinning to major version tag instead as it will get any new security updates as soon as they are released and if the action is no longer properly maintained, it can be tagged as such. Only Python allows setting minimum (and maximum) version for dependencies thus avoiding both breaking changes and known vulnerable or broken releases. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
All seven CI workflows lacked a top-level
permissions:block, so eachrun inherited the repository default, which can be write-all on permissive
settings. Every workflow now has
permissions: read-allat the toplevel, restricting the GITHUB_TOKEN to the minimum required for build and
test jobs.
In addition, every action reference that used a mutable version tag was
pinned to its full commit SHA. A tag can be silently moved; a SHA
cannot.
Actions pinned
Verification
Result: 0 high-severity findings after this patch (down from 26).
The remaining 3 medium findings are style warnings about
read-allbeingbroader than individual per-permission declarations — they are not a
regression and reflect the same posture as adding
permissions: read-allto any workflow.