Skip to content

Conversation

@Ramyromel
Copy link

@Ramyromel Ramyromel commented Jan 26, 2025

Fixes #198

Add fine-grained permissions for GitHub tokens in multiple workflow files to enhance security by limiting access scope.

  • Documentation Update

    • Add a section on using fine-grained permissions for GitHub tokens in docs/Solutions/FixGITHUB_TOKENPermissions.md.
    • Include an example of setting permissions: contents: read in a workflow file.
    • Mention the importance of the principle of least privilege.
  • Workflow Files Update

    • Add permissions: contents: read under the on section in .github/workflows/hosted-network-filtering-hr.yml.
    • Add permissions: contents: read under the on section in .github/workflows/hosted-file-monitor-with-hr.yml.
    • Add permissions: contents: read under the on section in .github/workflows/hosted-file-monitor-without-hr.yml.
    • Add permissions: contents: read under the on section in .github/workflows/hosted-https-monitoring-hr.yml.
    • Add permissions: contents: read under the on section in .github/workflows/hosted-network-monitoring-hr.yml.
    • Add permissions: contents: read under the on section in .github/workflows/hosted-network-without-hr.yml.
    • Add permissions: contents: read under the on section in .github/workflows/arc-codecov-simulation.yml.
    • Add permissions: contents: read under the on section in .github/workflows/arc-secure-by-default.yml.
    • Add permissions: contents: read under the on section in .github/workflows/arc-solarwinds-simulation.yml.
    • Add permissions: contents: read under the on section in .github/workflows/arc-zero-effort-observability.yml.
    • Add permissions: contents: read under the on section in .github/workflows/baseline_checks.yml.
    • Add permissions: contents: read under the on section in .github/workflows/block-dns-exfiltration.yaml.
    • Add permissions: contents: read under the on section in .github/workflows/changed-files-vulnerability-with-hr.yml.
    • Add permissions: contents: read under the on section in .github/workflows/changed-files-vulnerability-without-hr.yml.
    • Add permissions: contents: read under the on section in .github/workflows/publish.yml.
    • Add permissions: contents: read under the on section in .github/workflows/self-hosted-file-monitor-with-hr.yml.
    • Add permissions: contents: read under the on section in .github/workflows/self-hosted-network-filtering-hr.yml.
    • Add permissions: contents: read under the on section in .github/workflows/self-hosted-network-monitoring-hr.yml.
    • Add permissions: contents: read under the on section in .github/workflows/unexpected-outbound-calls.yml.
    • Add permissions: contents: read under the on section in .github/workflows/anomalous-outbound-calls.yaml.

For more details, open the Copilot Workspace session.

Fixes step-security#198

Add fine-grained permissions for GitHub tokens in multiple workflow files to enhance security by limiting access scope.

* **Documentation Update**
  - Add a section on using fine-grained permissions for GitHub tokens in `docs/Solutions/FixGITHUB_TOKENPermissions.md`.
  - Include an example of setting `permissions: contents: read` in a workflow file.
  - Mention the importance of the principle of least privilege.

* **Workflow Files Update**
  - Add `permissions: contents: read` under the `on` section in `.github/workflows/hosted-network-filtering-hr.yml`.
  - Add `permissions: contents: read` under the `on` section in `.github/workflows/hosted-file-monitor-with-hr.yml`.
  - Add `permissions: contents: read` under the `on` section in `.github/workflows/hosted-file-monitor-without-hr.yml`.
  - Add `permissions: contents: read` under the `on` section in `.github/workflows/hosted-https-monitoring-hr.yml`.
  - Add `permissions: contents: read` under the `on` section in `.github/workflows/hosted-network-monitoring-hr.yml`.
  - Add `permissions: contents: read` under the `on` section in `.github/workflows/hosted-network-without-hr.yml`.
  - Add `permissions: contents: read` under the `on` section in `.github/workflows/arc-codecov-simulation.yml`.
  - Add `permissions: contents: read` under the `on` section in `.github/workflows/arc-secure-by-default.yml`.
  - Add `permissions: contents: read` under the `on` section in `.github/workflows/arc-solarwinds-simulation.yml`.
  - Add `permissions: contents: read` under the `on` section in `.github/workflows/arc-zero-effort-observability.yml`.
  - Add `permissions: contents: read` under the `on` section in `.github/workflows/baseline_checks.yml`.
  - Add `permissions: contents: read` under the `on` section in `.github/workflows/block-dns-exfiltration.yaml`.
  - Add `permissions: contents: read` under the `on` section in `.github/workflows/changed-files-vulnerability-with-hr.yml`.
  - Add `permissions: contents: read` under the `on` section in `.github/workflows/changed-files-vulnerability-without-hr.yml`.
  - Add `permissions: contents: read` under the `on` section in `.github/workflows/publish.yml`.
  - Add `permissions: contents: read` under the `on` section in `.github/workflows/self-hosted-file-monitor-with-hr.yml`.
  - Add `permissions: contents: read` under the `on` section in `.github/workflows/self-hosted-network-filtering-hr.yml`.
  - Add `permissions: contents: read` under the `on` section in `.github/workflows/self-hosted-network-monitoring-hr.yml`.
  - Add `permissions: contents: read` under the `on` section in `.github/workflows/unexpected-outbound-calls.yml`.
  - Add `permissions: contents: read` under the `on` section in `.github/workflows/anomalous-outbound-calls.yaml`.

---

For more details, open the [Copilot Workspace session](https://copilot-workspace.githubnext.com/step-security/github-actions-goat/issues/198?shareId=XXXX-XXXX-XXXX-XXXX).
@varunsh-coder
Copy link
Member

@Ramyromel did you mean to create this PR in your own fork?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Harden GitHub Actions Workflow - hosted-network-filtering-hr.yml

2 participants