Skip to content

Commit 48033fc

Browse files
cwize1cwize1
authored
Fix workflow permissions. (#367)
The permissions at the top of the workflow file apply to all jobs within the file. So, explicitly set this to nothing to ensure there are no default permissions. Then, set explicit permissions on each job, to only what each job needs.
1 parent 9e239fb commit 48033fc

19 files changed

+143
-85
lines changed

‎.github/workflows/binary-build.yml

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,7 @@
33

44
name: Build binary and container for single arch
55

6-
permissions:
7-
contents: read
6+
permissions: {}
87

98
on:
109
workflow_call:

‎.github/workflows/build-dev.yml

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,10 +3,7 @@
33

44
name: Build (dev)
55

6-
permissions:
7-
contents: read
8-
# Azure login.
9-
id-token: write
6+
permissions: {}
107

118
on:
129
pull_request:
@@ -34,3 +31,7 @@ jobs:
3431
publishType: dev
3532
runFunctionalTests: ${{ inputs.runFunctionalTests || false }}
3633
runVMTests: ${{ inputs.runVMTests || false }}
34+
permissions:
35+
contents: read
36+
# Azure login.
37+
id-token: write

‎.github/workflows/build-main.yml

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,10 +3,7 @@
33

44
name: Build (main)
55

6-
permissions:
7-
contents: read
8-
# Azure login.
9-
id-token: write
6+
permissions: {}
107

118
on:
129
push:
@@ -16,6 +13,10 @@ on:
1613
jobs:
1714
build:
1815
uses: ./.github/workflows/build.yml
16+
permissions:
17+
contents: read
18+
# Azure login.
19+
id-token: write
1920
with:
2021
publishType: main
2122
runFunctionalTests: true

‎.github/workflows/build-preview.yml

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,10 +3,7 @@
33

44
name: Build (preview)
55

6-
permissions:
7-
contents: read
8-
# Azure login.
9-
id-token: write
6+
permissions: {}
107

118
on:
129
push:
@@ -16,6 +13,10 @@ on:
1613
jobs:
1714
build:
1815
uses: ./.github/workflows/build.yml
16+
permissions:
17+
contents: read
18+
# Azure login.
19+
id-token: write
1920
with:
2021
publishType: preview
2122
runFunctionalTests: true

‎.github/workflows/build.yml

Lines changed: 64 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -3,10 +3,7 @@
33

44
name: Build binary, container, and docs
55

6-
permissions:
7-
contents: read
8-
# Azure login.
9-
id-token: write
6+
permissions: {}
107

118
on:
129
workflow_call:
@@ -31,16 +28,22 @@ jobs:
3128
with:
3229
publishType: ${{ inputs.publishType }}
3330
arch: amd64
31+
permissions:
32+
contents: read
3433

3534
binary-build-arm64:
3635
name: Build ARM64
3736
uses: ./.github/workflows/binary-build.yml
3837
with:
3938
publishType: ${{ inputs.publishType }}
4039
arch: arm64
40+
permissions:
41+
contents: read
4142

4243
build-docs:
4344
uses: ./.github/workflows/docs-build.yml
45+
permissions:
46+
contents: read
4447

4548
tests-functional-azl3-amd64:
4649
name: Functional tests AZL3 AMD64
@@ -49,14 +52,22 @@ jobs:
4952
with:
5053
hostArch: amd64
5154
hostDistro: azl3
55+
permissions:
56+
contents: read
57+
# Azure login.
58+
id-token: write
5259

5360
tests-functional-azl3-arm64:
54-
name: Functional tests AZL3 ARM64
55-
if: ${{ inputs.runFunctionalTests }}
56-
uses: ./.github/workflows/tests-functional.yml
57-
with:
58-
hostArch: arm64
59-
hostDistro: azl3
61+
name: Functional tests AZL3 ARM64
62+
if: ${{ inputs.runFunctionalTests }}
63+
uses: ./.github/workflows/tests-functional.yml
64+
with:
65+
hostArch: arm64
66+
hostDistro: azl3
67+
permissions:
68+
contents: read
69+
# Azure login.
70+
id-token: write
6071

6172
tests-functional-ubuntu2404-amd64:
6273
name: Functional tests Ubuntu24.04 AMD64
@@ -65,6 +76,10 @@ jobs:
6576
with:
6677
hostArch: amd64
6778
hostDistro: ubuntu2404
79+
permissions:
80+
contents: read
81+
# Azure login.
82+
id-token: write
6883

6984
tests-functional-ubuntu2404-arm64:
7085
name: Functional tests Ubuntu24.04 ARM64
@@ -73,6 +88,10 @@ jobs:
7388
with:
7489
hostArch: arm64
7590
hostDistro: ubuntu2404
91+
permissions:
92+
contents: read
93+
# Azure login.
94+
id-token: write
7695

7796
imagecreator-tests-functional-azl3-amd64:
7897
name: Functional tests AZL3 AMD64
@@ -81,6 +100,8 @@ jobs:
81100
with:
82101
hostArch: amd64
83102
hostDistro: azl3
103+
permissions:
104+
contents: read
84105

85106
imagecreator-tests-functional-ubuntu2404-amd64:
86107
name: Functional tests Ubuntu24.04 AMD64
@@ -89,6 +110,8 @@ jobs:
89110
with:
90111
hostArch: amd64
91112
hostDistro: ubuntu2404
113+
permissions:
114+
contents: read
92115

93116
tests-vmtests-azl3-amd64:
94117
name: VMTests suite AZL3 AMD64
@@ -98,6 +121,10 @@ jobs:
98121
with:
99122
hostArch: amd64
100123
hostDistro: azl3
124+
permissions:
125+
contents: read
126+
# Azure login.
127+
id-token: write
101128

102129
tests-vmtests-ubuntu2404-amd64:
103130
name: VMTests suite Ubuntu24.04 AMD64
@@ -107,6 +134,10 @@ jobs:
107134
with:
108135
hostArch: amd64
109136
hostDistro: ubuntu2404
137+
permissions:
138+
contents: read
139+
# Azure login.
140+
id-token: write
110141

111142
tests-vmtests-ubuntu2404-arm64:
112143
name: VMTests suite Ubuntu24.04 ARM64
@@ -116,6 +147,10 @@ jobs:
116147
with:
117148
hostArch: arm64
118149
hostDistro: ubuntu2404
150+
permissions:
151+
contents: read
152+
# Azure login.
153+
id-token: write
119154

120155
tests-vmtests-imagecreator-azl3-amd64:
121156
name: VMTests suite image creator AZL3 AMD64
@@ -125,6 +160,8 @@ jobs:
125160
with:
126161
hostArch: amd64
127162
hostDistro: azl3
163+
permissions:
164+
contents: read
128165

129166
tests-vmtests-imagecreator-ubuntu2404-amd64:
130167
name: VMTests suite image creator Ubuntu24.04 AMD64
@@ -133,7 +170,9 @@ jobs:
133170
uses: ./.github/workflows/tests-vmtests-imagecreator.yml
134171
with:
135172
hostArch: amd64
136-
hostDistro: ubuntu2404
173+
hostDistro: ubuntu2404
174+
permissions:
175+
contents: read
137176

138177
tests-vmtests-imagecreator-ubuntu2404-arm64:
139178
name: VMTests suite image creator Ubuntu24.04 ARM64
@@ -143,6 +182,8 @@ jobs:
143182
with:
144183
hostArch: arm64
145184
hostDistro: ubuntu2404
185+
permissions:
186+
contents: read
146187

147188
tests-vmtests-osmodifier-azl3-amd64:
148189
name: VMTests suite osmodifier AZL3 AMD64
@@ -152,6 +193,10 @@ jobs:
152193
with:
153194
hostArch: amd64
154195
hostDistro: azl3
196+
permissions:
197+
contents: read
198+
# Azure login.
199+
id-token: write
155200

156201
tests-vmtests-osmodifier-ubuntu2404-amd64:
157202
name: VMTests suite osmodifier Ubuntu24.04 AMD64
@@ -161,6 +206,10 @@ jobs:
161206
with:
162207
hostArch: amd64
163208
hostDistro: ubuntu2404
209+
permissions:
210+
contents: read
211+
# Azure login.
212+
id-token: write
164213

165214
tests-vmtests-osmodifier-ubuntu2404-arm64:
166215
name: VMTests suite osmodifier Ubuntu24.04 ARM64
@@ -170,3 +219,7 @@ jobs:
170219
with:
171220
hostArch: arm64
172221
hostDistro: ubuntu2404
222+
permissions:
223+
contents: read
224+
# Azure login.
225+
id-token: write

‎.github/workflows/docs-build.yml

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,6 @@
11
name: Build docs
22

3-
permissions:
4-
contents: read
3+
permissions: {}
54

65
on:
76
workflow_call: {}

‎.github/workflows/fork-release-branch.yml

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,7 @@
33

44
name: Fork release branch
55

6-
permissions:
7-
# Create release branch.
8-
contents: write
6+
permissions: {}
97

108
on:
119
workflow_call: {}

‎.github/workflows/imagecreator-tests-functional.yml

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,7 @@
33

44
name: Tests Image Creator functional
55

6-
permissions:
7-
contents: read
6+
permissions: {}
87

98
on:
109
workflow_call:

‎.github/workflows/open-bump-version-pr.yml

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -3,11 +3,7 @@
33

44
name: Open bump version PR
55

6-
permissions:
7-
# Create release branch and publish release.
8-
contents: write
9-
# Publish PR.
10-
#pull-requests: write
6+
permissions: {}
117

128
on:
139
workflow_call: {}

‎.github/workflows/publish-container.yml

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,6 @@
11
name: Publish container to GHCR
22

3-
permissions:
4-
# "Keyless" container signing
5-
id-token: write
6-
# Publish to GHCR.
7-
packages: write
3+
permissions: {}
84

95
on:
106
workflow_call: {}

0 commit comments

Comments
 (0)