Your Web News in One Place

Help Webnuz

Referal links:

Sign up for GreenGeeks web hosting
July 21, 2021 12:45 am GMT

How to set GitHub Actions's `permissions`?

GitHub introduce permissions fields on GitHub Actions for security reasons.

The permissions field will help you to prevent software supply chain attack.

For example, codecov's bash script is hacked recently.

This supply chain attack affects to CI like Circle CI, GitHub Actions.

GitHub Actions can limit each actions's permissions.

For example, next permissios only allow the action to read repo's content.

permissions:    contents: read

The default permissions is write-all.
Of course, you can change the default workflow permission of the repository.

So, you need to do following to improve security of GitHub Actions.

  • Change the default permissiont to "Read repository contents permission "
  • Write each actions's permissions to yaml files

However, permissions is optional and it is a little of hard to set. Because, almost actions does not provides permissions guide.

@pkgdeps/update-github-actions-permissions

I've created a tool that update GitHub Actions's permissions automatically.

This tools detect using Actions and add permissions field to your action yaml file.

Requirements: Node.js 14+

You can update your GitHub Actions via following command:

npx @pkgdeps/update-github-actions-permissions ".github/workflows/*.{yaml,yml}"

update-github-actions-permissions result

This tool supports 40+ actions.

If you found missing actions, please submit a pull request.

Related


Original Link: https://dev.to/azu/how-to-set-github-actions-s-permissions-hln

Share this article:    Share on Facebook
View Full Article

Dev To

An online community for sharing and discovering great ideas, having debates, and making friends

More About this Source Visit Dev To