[BUILD] Add top level permission restriction for GITHUB_TOKEN#60
[BUILD] Add top level permission restriction for GITHUB_TOKEN#60MacOS wants to merge 4 commits intotelekom:mainfrom
Conversation
…rict GITHUB_TOKEN so to be consistent with the others
|
@BhaskarNS-iOS and @ShashilPohankar - please review my PR. |
There was a problem hiding this comment.
Pull Request Overview
This PR enhances security by restricting the GITHUB_TOKEN permissions to read access across multiple GitHub Actions workflows.
- Adds an explicit top-level permissions block setting 'contents: read' for the token.
- Replaces a broader 'read-all' permission with a scoped 'contents: read' in the openssf-scorecard workflow.
Reviewed Changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 4 comments.
| File | Description |
|---|---|
| .github/workflows/reuse-compliance.yml | Added top-level 'permissions: contents: read' block to restrict the token. |
| .github/workflows/oss-review-toolkit.yml | Added top-level 'permissions: contents: read' block to restrict the token. |
| .github/workflows/openssf-scorecard.yml | Replaced 'read-all' with 'permissions: contents: read' to scope the permission. |
| .github/workflows/continuous-integration.yml | Added top-level 'permissions: contents: read' block to restrict the token. |
| permissions: | ||
| contents: read | ||
|
|
||
|
|
There was a problem hiding this comment.
[nitpick] Consider removing redundant blank lines after the permissions block to improve readability.
| permissions: | ||
| contents: read | ||
|
|
||
|
|
||
| jobs: | ||
| oss-review-toolkit: |
There was a problem hiding this comment.
[nitpick] Consider removing redundant blank lines following the permissions block for consistent formatting.
| permissions: | |
| contents: read | |
| jobs: | |
| oss-review-toolkit: | |
| permissions: | |
| contents: read | |
| jobs: | |
| oss-review-toolkit: |
| permissions: | ||
| contents: read | ||
|
|
||
|
|
There was a problem hiding this comment.
[nitpick] Consider removing redundant blank lines after the permissions block to maintain consistent formatting across workflow files.
| permissions: | ||
| contents: read | ||
|
|
||
|
|
||
| jobs: | ||
|
|
||
| swift-lint: |
There was a problem hiding this comment.
[nitpick] Consider removing redundant blank lines following the permissions block to maintain consistent formatting.
| permissions: | |
| contents: read | |
| jobs: | |
| swift-lint: | |
| permissions: | |
| contents: read | |
| jobs: | |
| swift-lint: |
This
PRadds the top level permission for read to restrct theGITHUB_TOKEN.This
PRmakes all workflows more secure by restricting the permission of theGITHUB_TOKEN, and does remediy security alerts such as Token-Permissions, which look like