Skip to content

ci: harden github actions permissions for scorecard compliance #2345

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Nov 3, 2025
Merged

ci: harden github actions permissions for scorecard compliance #2345

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion .github/workflows/assign-labels.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,10 +3,12 @@ name: Assign Labels
on: # yamllint disable-line rule:truthy
pull_request_target:

# default permissions as read only
permissions: read-all

jobs:
assign-labels:
permissions:
contents: read
pull-requests: write
issues: write
runs-on: ubuntu-latest
Expand Down
4 changes: 3 additions & 1 deletion .github/workflows/check-x-crypto-deps.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,10 +3,12 @@ name: Check x/crypto
on: # yamllint disable-line rule:truthy
pull_request:

# default permissions as read only
permissions: read-all

jobs:
check-x-crypto-deps:
permissions:
contents: read
pull-requests: write
runs-on: ubuntu-latest
name: Check x/crypto Dependencies in Pull Request
Expand Down
3 changes: 3 additions & 0 deletions .github/workflows/config-change.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,9 @@ name: Check Config Changes
on: # yamllint disable-line rule:truthy
pull_request:

# default permissions as read only
permissions: read-all

jobs:
check-changes:
runs-on: ubuntu-latest
Expand Down
5 changes: 2 additions & 3 deletions .github/workflows/k8s-bm.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,9 +3,8 @@ name: Build and Deploy K8s on Self Hosted BM
on: # yamllint disable-line rule:truthy
pull_request:

permissions:
pull-requests: write
contents: write
# default permissions as read only
permissions: read-all

jobs:
check-changes:
Expand Down
12 changes: 12 additions & 0 deletions .github/workflows/pr-checks.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,9 @@ name: PR Checks
on: # yamllint disable-line rule:truthy
pull_request:

# default permissions as read only
permissions: read-all

jobs:
check-changes:
runs-on: ubuntu-latest
Expand Down Expand Up @@ -97,10 +100,19 @@ jobs:
test-and-codecov:
needs: check-changes
if: needs.check-changes.outputs.changes == 'true'
permissions:
Copy link
Collaborator

@SamYuan1990 SamYuan1990 Nov 3, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

a question here for this.
if https://github.com/sustainable-computing-io/kepler/pull/2345/files#diff-7a6a4578fe04c4fc86b28e2dc9672e48d1a9f721315e540b90bac0ef12263053R6-R8 set global permission for all jobs, why do we need a permission setting at here?

Copy link
Collaborator Author

@vprashar2929 vprashar2929 Nov 3, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

When using reusable workflows (jobs with the uses: keyword), permissions are not inherited from the
global permissions setting at the workflow level. This is a security feature in GitHub Actions.

The global permissions: read-all in the workflow only applies to regular jobs that run steps directly.
For jobs that call reusable workflows, we must explicitly declare what permissions should be passed
to the called workflow.

Without the explicit permissions, the test-and-codecov.yaml workflow would receive
no permissions (or minimal default permissions), which could cause it to fail.

contents: read
uses: ./.github/workflows/test-and-codecov.yaml
secrets:
CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

scorecard:
permissions:
contents: read
security-events: write
id-token: write
uses: ./.github/workflows/scorecard.yml

pre-commit:
runs-on: ubuntu-latest
steps:
Expand Down
7 changes: 4 additions & 3 deletions .github/workflows/pr-comment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,12 +11,13 @@ on: # yamllint disable-line rule:truthy
types:
- completed

permissions:
pull-requests: write
actions: read
# default permissions as read only
permissions: read-all

jobs:
comment-on-pr:
permissions:
pull-requests: write
runs-on: ubuntu-latest
# Only run if the triggering workflow succeeded
if: github.event.workflow_run.conclusion == 'success'
Expand Down
3 changes: 3 additions & 0 deletions .github/workflows/profiling.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,9 @@ name: Profiling Report
on: # yamllint disable-line rule:truthy
pull_request:

# default permissions as read only
permissions: read-all

jobs:
check-changes:
runs-on: ubuntu-latest
Expand Down
10 changes: 9 additions & 1 deletion .github/workflows/push.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,14 +4,22 @@ on: # yamllint disable-line rule:truthy
push:
branches: [main]

# default permissions as read only
permissions: read-all

jobs:
test-and-codecov:
permissions:
contents: read
Copy link
Collaborator

@SamYuan1990 SamYuan1990 Nov 3, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

will codecov write anything? as this job will run after push, can we double check with document or anyway to test it?

Copy link
Collaborator Author

@vprashar2929 vprashar2929 Nov 3, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No, Codecov does not write anything to the repository. contents: read is correct and
sufficient.

uses: ./.github/workflows/test-and-codecov.yaml
secrets:
CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

# for each PR merge, openSSF scan
scorecard:
permissions:
contents: read
security-events: write
id-token: write
uses: ./.github/workflows/scorecard.yml

publish:
Expand Down
59 changes: 44 additions & 15 deletions .github/workflows/release.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,15 +5,14 @@
tags:
- v[0-9]+.[0-9]+.[0-9]+

jobs:
release:
permissions:
contents: write
# default permissions as read only
permissions: read-all

jobs:
build:
runs-on: ubuntu-latest
env:
IMG_BASE: quay.io/sustainable_computing_io

steps:
- name: Checkout source
uses: actions/checkout@v5
Expand Down Expand Up @@ -90,19 +89,14 @@
# Currently the binary is built for linux-amd64 only
tar -czvf bin/kepler-${VERSION}.linux-amd64.tar.gz bin/kepler
- name: Create GitHub Release
uses: softprops/action-gh-release@v2
- name: Upload Release Artifacts
uses: actions/upload-artifact@v4

Check warning

Code scanning / Scorecard

Pinned-Dependencies Medium

score is 0: GitHub-owned GitHubAction not pinned by hash
Remediation tip: update your workflow using https://app.stepsecurity.io
Click Remediation section below for further remediation help
with:

Check warning

Code scanning / Scorecard

Pinned-Dependencies Medium

score is 0: third-party GitHubAction not pinned by hash
Remediation tip: update your workflow using https://app.stepsecurity.io
Click Remediation section below for further remediation help
tag_name: ${{ github.ref_name }}
name: release-${{ steps.version.outputs.version }}
generate_release_notes: true
draft: false
make_latest: true
files: |
name: release-artifacts
retention-days: 1 # Keep the artifacts for 1 day
path: |
helm-releases/*.tgz
bin/*.tar.gz
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- name: Push Image
shell: bash
Expand All @@ -116,3 +110,38 @@
# Remove 'v' prefix from version
CHART_VERSION=${VERSION#v}
helm push helm-releases/kepler-helm-${CHART_VERSION}.tgz oci://${{ env.IMG_BASE }}/charts
release:
needs: build
permissions:
# contents: write is required for publishing Github Releases
# This follows Github's recommended pattern: top-level read-all with minimal job-level permissions
# See: https://github.com/softprops/action-gh-release?tab=readme-ov-file#permissions
contents: write
runs-on: ubuntu-latest
steps:
- name: Download Release Artifacts
uses: actions/download-artifact@v4

Check warning

Code scanning / Scorecard

Pinned-Dependencies Medium

score is 0: GitHub-owned GitHubAction not pinned by hash
Remediation tip: update your workflow using https://app.stepsecurity.io
Click Remediation section below for further remediation help
with:
name: release-artifacts

- name: Extract version
shell: bash
id: version
run: |
TAG_NAME=${{ github.ref_name }}
echo "version=$TAG_NAME" >> "$GITHUB_OUTPUT"
- name: Create GitHub Release
uses: softprops/action-gh-release@v2
with:
tag_name: ${{ github.ref_name }}
name: release-${{ steps.version.outputs.version }}
Copy link
Collaborator

@SamYuan1990 SamYuan1990 Nov 3, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

release-${{ github.ref_name }} ?
if in this new design we just have bash here for ... value injection?

Copy link
Collaborator Author

@vprashar2929 vprashar2929 Nov 3, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yes we can use release-${{ github.ref_name }} How about I update it in this #2347 ?

generate_release_notes: true
draft: false
make_latest: true
files: |
helm-releases/*.tgz
bin/*.tar.gz
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
10 changes: 6 additions & 4 deletions .github/workflows/scorecard.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,20 +6,22 @@ name: Scorecard supply-chain security
on: # yamllint disable-line rule:truthy
workflow_call:

# Declare default permissions as read only.
permissions: read-all
# Restrict permissions for GITHUB_TOKEN by default.
# Each job must explicitly declare what it needs.
permissions: {}

jobs:
analysis:
name: Scorecard analysis
runs-on: ubuntu-latest
permissions:
# Needed to checkout code.
contents: read
# Needed to upload the results to code-scanning dashboard.
security-events: write
# Needed to publish results and get a badge (see publish_results below).
id-token: write
# Uncomment the permissions below if installing in a private repository.
# contents: read
# actions: read

steps:
Expand Down Expand Up @@ -55,7 +57,7 @@ jobs:
with:
name: SARIF file
path: scorecard-results.sarif
retention-days: 5
retention-days: 1 # Keeping the results for 1 day

# Upload the results to GitHub's code scanning dashboard.
- name: Upload to code-scanning
Expand Down
8 changes: 8 additions & 0 deletions .github/workflows/test-and-codecov.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,9 +7,15 @@ on: # yamllint disable-line rule:truthy
description: Codecov token
required: true

# Restrict permissions for GITHUB_TOKEN by default.
# Each job must explicitly declare what it needs.
permissions: {}

jobs:
test:
runs-on: ubuntu-latest
permissions:
contents: read
steps:
- name: Checkout source
uses: actions/checkout@v5
Expand All @@ -32,6 +38,8 @@ jobs:
coverage-upload:
needs: test
runs-on: ubuntu-latest
permissions:
contents: read
steps:
- name: Checkout source
uses: actions/checkout@v5
Expand Down
Loading