Make CI/CD more secure - Githubissues

uabrc / uabrc.github.io

UAB Research Computing Documentation

https://docs.rc.uab.edu

21 stars 12 forks source link

Make CI/CD more secure #783

Open wwarriner opened 4 weeks ago

wwarriner commented 4 weeks ago

Use this: https://github.com/marketplace/actions/deploy-mkdocs

Use a GitHub Token to and make gh-pages a protected branch only the bot can access.

wwarriner commented 3 weeks ago

Not feasible at this time due to security implications of current github permissions framework. The closest I can get is

(1) Trust the team to never merge PRs to gh-pages directly (2) Restrict approve/request changes reviews to explicitly-added collaborators, i.e., our team. So no "drive by" PR + review combos. This is done on this repository.