mirror of
https://github.com/apple/container.git
synced 2026-09-12 10:45:42 +00:00
Melissa Kilby
26dcd68340
See https://github.com/swiftlang/github-workflows/issues/167 for additional context This approach aligns with security best practices, as detailed in the following documentation: - https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions - https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#defining-access-for-the-github_token-scopes - https://openssf.org/blog/2024/08/12/mitigating-attack-vectors-in-github-workflows/ The default GITHUB_TOKEN permissions are defined at the repository level. This PR modifies the workflow-level overrides to conform to OpenSSF best practices -> defense in depth. Allow me to quote OpenSSF: https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions > The highest score is awarded when the permissions definitions in each workflow's yaml file are set as read-only at the top level and the required write permissions are declared at the run-level.” > Remediation steps > - Set top-level permissions as read-all or contents: read as described in GitHub's documentation. > - Set any required write permissions at the job-level. Only set the permissions required for that job; do not set permissions: write-all at the job level. Compare to the LLVM project: Top-level: contents read, e.g. https://github.com/swiftlang/llvm-project/blob/next/.github/workflows/build-ci-container-windows.yml#L3-L4 -> this makes it future-proof Job-level: Allow write permissions as needed, e.g. https://github.com/swiftlang/llvm-project/blob/next/.github/workflows/build-ci-container-windows.yml#L53-L58 Signed-off-by: Melissa Kilby <mkilby@apple.com>
58 lines
1.3 KiB
YAML
58 lines
1.3 KiB
YAML
name: Release containerization
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
on:
|
|
push:
|
|
tags:
|
|
- "[0-9]+\\.[0-9]+\\.[0-9]+"
|
|
|
|
jobs:
|
|
containerization:
|
|
uses: ./.github/workflows/containerization-build-template.yml
|
|
with:
|
|
release: true
|
|
version: ${{ github.ref_name }}
|
|
secrets: inherit
|
|
permissions:
|
|
contents: read
|
|
packages: write
|
|
pages: write
|
|
|
|
deployDocs:
|
|
if: startsWith(github.ref, 'refs/tags/')
|
|
runs-on: ubuntu-latest
|
|
needs: containerization
|
|
permissions:
|
|
contents: read
|
|
pages: write
|
|
id-token: write
|
|
environment:
|
|
name: github-pages
|
|
url: ${{ steps.deployment.outputs.page_url }}
|
|
steps:
|
|
- name: Deploy to GitHub Pages
|
|
id: deployment
|
|
uses: actions/deploy-pages@v4
|
|
|
|
release:
|
|
if: startsWith(github.ref, 'refs/tags/')
|
|
name: Publish release
|
|
timeout-minutes: 30
|
|
needs: containerization
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: write
|
|
packages: read
|
|
steps:
|
|
- name: Create release
|
|
uses: softprops/action-gh-release@v2
|
|
with:
|
|
token: ${{ github.token }}
|
|
name: ${{ github.ref_name }}-prerelease
|
|
draft: true
|
|
make_latest: false
|
|
prerelease: true
|
|
fail_on_unmatched_files: true
|