actions / runner

The Runner for GitHub Actions :rocket:
https://github.com/features/actions
MIT License
4.65k stars 895 forks source link

Runners do not log the `id-token` permission #3268

Open TapdancingRodent opened 2 months ago

TapdancingRodent commented 2 months ago

Disclaimer Please point me elsewhere if this isn't the right place to raise this. It seems like the runner only dumps a map it gets from the job context but I couldn't find where system.github.token.permissions is managed.

Describe the bug When a workflow sets the id-token permission the logs do not include it when reporting what permissions the GITHUB_TOKEN had. This is undesirable from a security and auditing perspective.

Related, but less important: the Attestations [edit: it looks like this was released yesterday] and Discussions permissions which are logged do not appear to be documented.

To Reproduce Add the below permissions block to a workflow (e.g. a simple example)

    permissions:
      id-token: write

and check the logs of the workflow run to see that the permissions are reported as

GITHUB_TOKEN Permissions
  Metadata: read

Expected behavior The logs would include (for instance)

GITHUB_TOKEN Permissions
  IdToken: write
  Metadata: read

Runner Version and Platform

This was tested on self-hosted runners in an EMU instance and on GitHub runners in a public repository. The reported version from the public repository are

Current runner version: '2.316.0'
Operating System
  Ubuntu
  [2](https://github.com/TapdancingRodent/stunning-octo-potato/actions/runs/8894662891/job/24423388853#step:1:2)2.04.4
  LTS
Runner Image
  Image: ubuntu-22.04
  Version: 20240422.1.0
  Included Software: https://github.com/actions/runner-images/blob/ubuntu22/20240422.1/images/ubuntu/Ubuntu2204-Readme.md
  Image Release: https://github.com/actions/runner-images/releases/tag/ubuntu22%2F20240422.1
Runner Image Provisioner
  2.0.[3](https://github.com/TapdancingRodent/stunning-octo-potato/actions/runs/8894662891/job/24423388853#step:1:3)69.1

What's not working?

See report body above

Job Log Output

See report body above

Runner and Worker's Diagnostic Logs

N/A