Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: permissions for build.yml #6083

Merged
merged 1 commit into from
Mar 8, 2022
Merged

fix: permissions for build.yml #6083

merged 1 commit into from
Mar 8, 2022

Conversation

Devils-Knight
Copy link
Contributor

GitHub asks users to define workflow permissions, see https://github.blog/changelog/2021-04-20-github-actions-control-permissions-for-github_token/ and https://docs.github.com/en/actions/security-guides/automatic-token-authentication#modifying-the-permissions-for-the-github_token for securing GitHub workflows against supply-chain attacks.

StepSecurity is working on securing GitHub workflows and OSSF Scorecards recommends using StepSecurity's secure-workflows online tool app.stepsecurity.io to improve the security of GitHub workflows.

We have fixed one of the repo's workflows for you by adding permissions for the involved jobs. You can secure the rest of the workflows for improved security by using the StepSecurity online tool at app.stepsecurity.io.

@boring-cyborg
Copy link

boring-cyborg bot commented Mar 2, 2022

Thanks for opening this pull request!

Please check out our contributor checklist and check if Travis or Codacy found any issues with your PR. Also make sure your commits are signed, and that you applied Bisq's code style and formatting.

A maintainer will add an is:priority label to your PR if it is up for compensation. Please see our Bisq Q1 2020 Update post for more details.

Copy link
Contributor

@ripcurlx ripcurlx left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

utACK - Changes are looking fine 👍

@ripcurlx ripcurlx added this to the v1.8.5 milestone Mar 8, 2022
@ripcurlx ripcurlx merged commit 185d80e into bisq-network:master Mar 8, 2022
@boring-cyborg
Copy link

boring-cyborg bot commented Mar 8, 2022

Awesome work, congrats on your first merged pull request!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants