ci: set top-level permissions for antithesis-verify workflow#21470
ci: set top-level permissions for antithesis-verify workflow#21470gaganhr94 wants to merge 1 commit intoetcd-io:mainfrom
Conversation
|
Hi @gaganhr94. Thanks for your PR. I'm waiting for a etcd-io member to verify that this patch is reasonable to test. If it is, they should reply with Regular contributors should join the org to skip this step. Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
k8s-ci-robot
added
github_actions
|
/ok-to-test |
|
@gaganhr94: Cannot trigger testing until a trusted user reviews the PR and leaves an DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
/assign @ivanvc |
|
/ok-to-test |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted filessee 21 files with indirect coverage changes @@ Coverage Diff @@
## main #21470 +/- ##
==========================================
+ Coverage 68.39% 68.42% +0.03%
==========================================
Files 428 428
Lines 35381 35381
==========================================
+ Hits 24200 24211 +11
+ Misses 9773 9761 -12
- Partials 1408 1409 +1 Continue to review full report in Codecov by Sentry.
🚀 New features to boost your workflow:
|
|
Hi, @gaganhr94, thanks for the pull request. We recently fixed an issue with building the Docker image from the workflow that you updated. Could you please rebase your branch? The workflow failure may come from that. Thanks. |
Add explicit `permissions: contents: read` at the workflow level to restrict the default GITHUB_TOKEN to read-only access, following the principle of least privilege. This addresses the OpenSSF Scorecard Token-Permissions warning for .github/workflows/antithesis-verify.yml. Signed-off-by: Gagan H R <hrgagan4@gmail.com>
gaganhr94
force-pushed
the
fix/token-permissions
branch
from
1dfb93d to
df975f2
Compare
|
Done @ivanvc |
|
/retest |
ivanvc
left a comment
ivanvc
left a comment
There was a problem hiding this comment.
LGTM. Thanks, @gaganhr94.
/cc @serathius @nwnt
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: gaganhr94, ivanvc The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
3 participants
Summary
Add explicit
permissions: contents: readat the workflow level in.github/workflows/antithesis-verify.ymlto restrict the defaultGITHUB_TOKENto read-only access, following the principle of least privilege.Fixes #21469
Changes
permissions: contents: readto theantithesis-verify.ymlworkflowWhy
The OpenSSF Scorecard
Token-Permissionscheck flagged this workflow for not defining top-level permissions:This change improves the repository's OpenSSF Scorecard score with no functional impact, as the workflow only checks out code and runs local Docker builds.