Set minimum permissions to workflows #132
Comments
sywhang
added a commit
to sywhang/atomic
that referenced
this issue
Mar 20, 2023
Set only read permission on CI workflows since they don't need write access. Fixes uber-go#132.
r-hang
pushed a commit
that referenced
this issue
Mar 20, 2023
Set only read permission on CI workflows since they don't need write access. Fixes #132.
# for free
to join this conversation on GitHub.
Already have an account?
# to comment
Setting minimum permissions to workflows is important to keep your repository safe against supply-chain attacks. I would like us to enforce least privilege access to workflows in the repository, similar to uber-go/multierr#76. The minimum permissions for the workflows,
fossa.yamlandgo.yml, would becontents: read. Let me know if you agree with the changes and if you'd like to implement them, as done in uber-go/multierr, or otherwise I'm available to implement too.Additional context
I'm Gabriela and I work on behalf of Google and the OpenSSF suggesting supply-chain security changes :)
The text was updated successfully, but these errors were encountered: