Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

ci: add GitHub token permissions #92999

Merged
merged 1 commit into from
May 21, 2022
Merged

ci: add GitHub token permissions #92999

merged 1 commit into from
May 21, 2022

Conversation

varunsh-coder
Copy link
Contributor

GitHub asks developers to define workflow permissions, see https://github.blog/changelog/2021-04-20-github-actions-control-permissions-for-github_token/ and https://docs.github.com/en/actions/security-guides/automatic-token-authentication#modifying-the-permissions-for-the-github_token for securing GitHub workflows against supply-chain attacks.

The Open Source Security Foundation (OpenSSF) Scorecards also treats not setting token permissions as a high-risk issue.

This PR adds minimum token permissions for the GITHUB_TOKEN using https://github.com/step-security/secure-workflows.

This project is part of the top 100 critical projects as per OpenSSF (https://github.com/ossf/wg-securing-critical-projects), so fixing the token permissions to improve security.

@cpython-cla-bot
Copy link

cpython-cla-bot bot commented May 20, 2022 •
edited
Loading

All commit authors signed the Contributor License Agreement.
CLA signed

@bedevere-bot
Copy link

Most changes to Python require a NEWS entry.

Please add it using the blurb_it web app or the blurb command-line tool.

@varunsh-coder varunsh-coder mentioned this pull request May 20, 2022
Open
@erlend-aasland erlend-aasland requested review from ewdurbin and zware May 20, 2022 07:28
@ewdurbin ewdurbin mentioned this pull request May 21, 2022
Merged
@ewdurbin ewdurbin merged commit b96e20c into python:main May 21, 2022
@ewdurbin
Copy link
Member

Thank you @varunsh-coder

@varunsh-coder varunsh-coder mentioned this pull request Jul 28, 2022
Open
32 tasks
@ezio-melotti
Copy link
Member

@ewdurbin, any reason not to backport this PR to 3.11/3.10?

@ezio-melotti ezio-melotti mentioned this pull request Oct 9, 2022
Merged
@ewdurbin
Copy link
Member

@ezio-melotti not that I'm aware of unless the workflows do not exist.

@ezio-melotti ezio-melotti added needs backport to 3.10 only security fixes needs backport to 3.11 only security fixes labels Oct 10, 2022
@miss-islington
Copy link
Contributor

Thanks @varunsh-coder for the PR, and @ewdurbin for merging it 🌮🎉.. I'm working now to backport this PR to: 3.11.
🐍🍒⛏🤖

@miss-islington
Copy link
Contributor

Thanks @varunsh-coder for the PR, and @ewdurbin for merging it 🌮🎉.. I'm working now to backport this PR to: 3.10.
🐍🍒⛏🤖

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Oct 10, 2022
@varunsh-coder @miss-islington
ci: add GitHub token permissions (pythonGH-92999)
5ad81c0 
(cherry picked from commit b96e20c)

Co-authored-by: Varun Sharma <varunsh@stepsecurity.io>
@bedevere-bot bedevere-bot removed the needs backport to 3.11 only security fixes label Oct 10, 2022
@miss-islington
Copy link
Contributor

Sorry, @varunsh-coder and @ewdurbin, I could not cleanly backport this to 3.10 due to a conflict.
Please backport using cherry_picker on command line.
cherry_picker b96e20c1d9be4e6d5ea3e48c9c97e5ecd02f6055 3.10

@bedevere-bot
Copy link

GH-98160 is a backport of this pull request to the 3.11 branch.

@bedevere-bot
Copy link

GH-98161 is a backport of this pull request to the 3.10 branch.

@bedevere-bot bedevere-bot removed the needs backport to 3.10 only security fixes label Oct 10, 2022
@ezio-melotti ezio-melotti mentioned this pull request Oct 10, 2022
Closed
miss-islington added a commit that referenced this pull request Oct 10, 2022
@miss-islington @varunsh-coder
ci: add GitHub token permissions (GH-92999)
1269297 
(cherry picked from commit b96e20c)

Co-authored-by: Varun Sharma <varunsh@stepsecurity.io>
ezio-melotti added a commit that referenced this pull request Oct 10, 2022
@ezio-melotti @varunsh-coder
[3.10] ci: add GitHub token permissions (GH-92999) (#98161)
64ce2cb 
* ci: add GitHub token permissions (#92999)

(cherry picked from commit b96e20c)

* [3.10] ci: add GitHub token permissions (GH-92999).
(cherry picked from commit b96e20c)

Co-authored-by: Varun Sharma <varunsh@stepsecurity.io>

Co-authored-by: Varun Sharma <varunsh@stepsecurity.io>
@pnacht pnacht mentioned this pull request Nov 21, 2022
Open
@ashishkurmi ashishkurmi mentioned this pull request Dec 21, 2022
Open
87 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@ewdurbin ewdurbin ewdurbin approved these changes

@zware zware Awaiting requested review from zware

Assignees

@ewdurbin ewdurbin

Labels
skip issue skip news
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
6 participants
@varunsh-coder @bedevere-bot @ewdurbin @ezio-melotti @miss-islington @erlend-aasland