Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add top-level permissions to workflows #545

Merged
merged 1 commit into from
Oct 2, 2024

Conversation

carlewis
Copy link
Contributor

@carlewis carlewis commented Oct 2, 2024

Overview

Add top-level permissions to workflows.

Reason for change

Token-Permissions is one of the HIGH priority items on OpenSSF Scorecard

Description of change

Top level token permissions limit the scope of the github token so it can't access more resources than needed.
Most actions don't need access to all available resources.
Documentation can be found here:
https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/controlling-permissions-for-github_token

Anything else we should know?

Checklist

  • Read and follow the project Code of Conduct.
  • Make sure the project builds successfully with your changes.
  • Run relevant testing locally to avoid regressions.
  • Run clang-format-17 on all modified code.

@carlewis carlewis requested a review from a team as a code owner October 2, 2024 12:27
@carlewis carlewis merged commit 20f29df into uxlfoundation:main Oct 2, 2024
10 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants