search

w3c / IntersectionObserver

Intersection Observer
https://www.w3.org/TR/intersection-observer/
Other
3.62k stars 523 forks source link

Set minimum permissions for workflows #507

Closed gabibguti closed 1 year ago

gabibguti commented 1 year ago

Set minimum permissions to workflows is important to keep your repository safe against supply-chain attacks. GitHub gives a GITHUB_TOKEN for workflows to perform actions. The problem is that GITHUB_TOKEN is granted higher permissions by default, making way to supply-chain attacks. If you agree, I can try to adjust the permissions for auto-publish.yml workflow in a PR :)

This setting is considered good-practice and recommended by GitHub itself and by other security tools, such as Scorecards and StepSecurity.

Additional context About me, I'm Gabriela and I work on behalf of Google and the OpenSSF suggesting supply-chain security changes :)

gabibguti commented 1 year ago

Hi! Friendly ping here. This issue has been idle for quite some time. Do you plan on considering these changes? If yes, please let me know! Otherwise I will wait up to 2 more months to close the issue. Thanks!

miketaylr commented 1 year ago

@gabibguti sure, a PR would be cool. Thanks.