Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Restrict all actions that rely on the GITHUB_TOKEN #27725

Merged
merged 2 commits into from
Jan 5, 2022
Merged

Restrict all actions that rely on the GITHUB_TOKEN #27725

merged 2 commits into from
Jan 5, 2022

Conversation

IEvangelist
Copy link
Member

Summary

In this PR, we're explicitly declaring the individual actions' permissions. This overrides the default permissions for the GITHUB_TOKEN, restricting it to the bare minimal access in order for the given action to run. For more information, see:

@dotnet-bot dotnet-bot added this to the January 2022 milestone Jan 4, 2022
@IEvangelist IEvangelist marked this pull request as ready for review January 4, 2022 16:02
@IEvangelist IEvangelist requested a review from a team as a code owner January 4, 2022 16:02
@IEvangelist IEvangelist added security-practices/subsvc Pri1 High priority, do before Pri2 and Pri3 labels Jan 4, 2022
@IEvangelist IEvangelist self-assigned this Jan 4, 2022
adegeo
adegeo approved these changes Jan 5, 2022
View reviewed changes
Copy link
Contributor

@adegeo adegeo left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this should be fine.

@IEvangelist IEvangelist merged commit 73fb943 into dotnet:main Jan 5, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@adegeo adegeo adegeo approved these changes

@BillWagner BillWagner Awaiting requested review from BillWagner

Assignees

@IEvangelist IEvangelist

Labels
Pri1 High priority, do before Pri2 and Pri3 security-practices/subsvc
Projects
None yet
Milestone
January 2022
Development

Successfully merging this pull request may close these issues.
3 participants
@IEvangelist @adegeo @dotnet-bot