10000 BUILD: add permissions to github actions by mattip · Pull Request #22367 · numpy/numpy · GitHub
[go: up one dir, main page]
Skip to content

BUILD: add permissions to github actions #22367

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 1 commit into from
Oct 2, 2022
Merged

BUILD: add permissions to github actions #22367

merged 1 commit into from
Oct 2, 2022

Conversation

mattip
Copy link
Member
@mattip mattip commented Oct 2, 2022

Inspired by cython/cython#5038, here is the comment by @sashashuri there

This PR adds explicit permissions section to workflows. This is a security best practice because by default workflows run with extended set of permissions (except from on: pull_request from external forks). By specifying any permission explicitly all others are set to none. By using the principle of least privilege the damage a compromised workflow can do (because of an injection or compromised third party tool or action) is restricted.
It is recommended to have most strict permissions on the top level and grant write permissions on job level case by case.

@charris charris merged commit 737016f into numpy:main Oct 2, 2022
@charris
Copy link
Member
charris commented Oct 2, 2022

Thanks Matti.

@mattip mattip mentioned this pull request Oct 3, 2022
Merged
@tupui tupui mentioned this pull request Oct 3, 2022
Merged
@rgommers rgommers mentioned this pull request Nov 4, 2022
Merged
@rossbar rossbar mentioned this pull request Nov 10, 2022
Merged
@mattip mattip deleted the ci-permissions branch December 27, 2022 16:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@mattip @charris
0