search

allenai / allennlp

An open-source NLP research library, built on PyTorch.
http://www.allennlp.org
Apache License 2.0
11.74k stars 2.24k forks source link

Set permissions for GitHub actions #5622

Closed naveensrinivasan closed 2 years ago

naveensrinivasan commented 2 years ago

https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions

https://docs.github.com/en/actions/using-jobs/assigning-permissions-to-jobs

Keeping your GitHub Actions and workflows secure Part 1: Preventing pwn requests

Restrict the GitHub token permissions only to the required ones; this way, even if the attackers will succeed in compromising your workflow, they won’t be able to do much.

Signed-off-by: naveensrinivasan 172697+naveensrinivasan@users.noreply.github.com

epwalsh commented 2 years ago

The workflow you modified only runs on a schedule, and needs write permissions. So I don't think we want this change. I'm happy to reopen if proven wrong.