search

kubernetes-sigs / kubebuilder-release-tools

Release tooling for KubeBuilder projects.
Apache License 2.0
18 stars 25 forks source link

GITHUB_TOKEN permissions used by this action #45

Open step-security-bot opened 2 years ago

step-security-bot commented 2 years ago

At https://github.com/step-security/secure-workflows we are building a knowledge-base (KB) of GITHUB_TOKEN permissions needed by different GitHub Actions. When developers try to set minimum token permissions for their workflows, they can use this knowledge-base instead of trying to research permissions needed by each GitHub Action they use.

Below you can see the KB of your GITHUB Action.

name: 'Verify KubeBuilder PRs'
github-token:
  action-input:
    input: github-token
    is-default: false
  permissions:
    checks: write
    checks-reason: to create and update checks #Checkout: https://github.com/kubernetes-sigs/kubebuilder-release-tools/blob/01981b8498d7b87658301e2a1b12c56b8c61067d/verify/pkg/action/plugin.go#L88
    pull-requests: read
    pull-requests-reason: to get PR title 
#Fixes #573

If you think this information is not accurate, or if in the future your GitHub Action starts using a different set of permissions, please create an issue at https://github.com/step-security/secure-workflows/issues to let us know.

This issue is automatically created by our analysis bot, feel free to close after reading :)

References:

GitHub asks users to define workflow permissions, see https://github.blog/changelog/2021-04-20-github-actions-control-permissions-for-github_token/ and https://docs.github.com/en/actions/security-guides/automatic-token-authentication#modifying-the-permissions-for-the-github_token for securing GitHub workflows against supply-chain attacks.

Setting minimum token permissions is also checked for by Open Source Security Foundation (OpenSSF) Scorecards. Scorecards recommend using https://github.com/step-security/secure-workflows so developers can fix this issue in an easier manner.

k8s-triage-robot commented 2 years ago

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

You can:

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

k8s-triage-robot commented 2 years ago

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

You can:

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten