cirrus-actions / rebase

GitHub Action to automatically rebase PRs
MIT License
686 stars 138 forks source link

Minimum level of permissions #84

Open PastaPastaPasta opened 3 years ago

PastaPastaPasta commented 3 years ago

I'm attempting to utilize this action, while minimizing the scope of it's permissions. Currently the action file has

permissions:
  contents: read
  pull-requests: write
  issues: read
  # Enforce other not needed permissions are off
  actions: none
  checks: none
  deployments: none
  packages: none
  repository-projects: none
  security-events: none
  statuses: none

However, this doesn't work the action says This check was skipped

What are the minimum required permissions for this to work?

varunsh-coder commented 2 years ago

Hi @PastaPastaPasta I am collating security info for different GitHub Actions and added the min permissions for this Action to the knowledge base here. You can try to set min permissions for a workflow that uses this Action here. Do share your feedback. Thanks!

laurentsimon commented 2 years ago

I was looking for this! I think they should update their documentation to explain this