search

caolan / async

Async utilities for node and the browser
http://caolan.github.io/async/
MIT License
28.18k stars 2.41k forks source link

chore: Set permissions for GitHub actions #1830

Closed naveensrinivasan closed 2 years ago

naveensrinivasan commented 2 years ago

Restrict the GitHub token permissions only to the required ones; this way, even if the attackers will succeed in compromising your workflow, they won’t be able to do much.

https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions

https://docs.github.com/en/actions/using-jobs/assigning-permissions-to-jobs

Keeping your GitHub Actions and workflows secure Part 1: Preventing pwn requests

Signed-off-by: naveensrinivasan 172697+naveensrinivasan@users.noreply.github.com

varunsh-coder commented 2 years ago

Hi @naveensrinivasan, I just noticed this PR. I had created similar one few days back :). https://github.com/caolan/async/pull/1829

Are you creating these in specific repos? I am planning to create in top 100 most critical projects. If you are creating these regularly, would love to divide and conquer. Let me know.

hargasinski commented 2 years ago

I'm closing this in favour of #1829. Thanks for the contribution though!