Repository navigation
Scope the workflow token, pin the actions, move off the retired runner - #308
Merged
Merged
Conversation
ci.yml declared no permissions, so the job ran on the repository default, which was a token with write access to everything. It is scoped to what release-drafter actually needs now: create the draft release, read merged pull requests for the notes. All nine action references are pinned to commit SHAs, so a moved tag cannot change what runs. Dependabot is already configured here and keeps the SHA and the trailing version comment in sync. ubuntu-20.04 was retired by GitHub and the Build runs have not been completing since. This moves to ubuntu-latest, which is the part that needs the CI run on this pull request to prove. 🤖
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Three things, from an Actions security pass across the pester org.
The token.
ci.ymldeclared nopermissionsblock at all, so the job ran on the repository default, which was a token with write access to everything - contents, packages, deployments, issues, security events. It is scoped now to what release-drafter needs:pull-requests: writeis only needed for release-drafter's autolabeler, which is not used here. If drafting turns out to need it, that is the one line to change.Pinning. All nine action references now point at commit SHAs, so a moved tag cannot change what runs. Dependabot is already configured in this repo and keeps the SHA and the trailing version comment in sync, so this does not become manual work.
The runner.
ubuntu-20.04was retired by GitHub, and the Build runs have not been completing since. This moves toubuntu-latest. That is the risky half of this change - if the build does not like the newer image, this pull request's own CI run is where it shows up. The other two changes are safe regardless.Once this merges, the repository default workflow token can go to read-only, which is already done for every other repo in the org.
🤖