From 9b2b9b7be287e6af07ef2f8223e2ea95fb75ed0d Mon Sep 17 00:00:00 2001 From: Michael Adam Date: Fri, 19 Jul 2024 16:44:40 +0200 Subject: [PATCH] ci: fix excessive token permissions Fixes: #14466 The OpenSSF scorecard report https://scorecard.dev/viewer/?uri=github.com/rook/rook warns about excessive token-permissions in the rook project's github CI workflows. This bulk change aims at improving this by 1. adding top-level read permissions where missing for integration tests. 2. adding write permissions as needed for the auto-assign workflow. 3. removing the warned-about and unused create-tag workflow Signed-off-by: Michael Adam Co-authored-by: Blaine Gardner --- .github/workflows/auto-assign.yaml | 6 +++ .../workflows/canary-integration-suite.yml | 3 ++ .github/workflows/create-tag.yaml | 42 ------------------- .github/workflows/daily-nightly-jobs.yml | 3 ++ .../integration-test-helm-suite.yaml | 3 ++ .../workflows/integration-test-mgr-suite.yaml | 3 ++ .../integration-test-multi-cluster-suite.yaml | 3 ++ .../integration-test-object-suite.yaml | 3 ++ .../integration-test-smoke-suite.yaml | 3 ++ .../integration-test-upgrade-suite.yaml | 3 ++ .../integration-tests-on-release.yaml | 3 ++ .github/workflows/multus.yaml | 3 ++ 12 files changed, 36 insertions(+), 42 deletions(-) delete mode 100644 .github/workflows/create-tag.yaml diff --git a/.github/workflows/auto-assign.yaml b/.github/workflows/auto-assign.yaml index 3da215ecb..75ac0f86f 100644 --- a/.github/workflows/auto-assign.yaml +++ b/.github/workflows/auto-assign.yaml @@ -3,8 +3,14 @@ on: issue_comment: types: [created, edited] +permissions: + contents: read + jobs: assign: + permissions: + # write permissions are needed to assign the issue. + contents: write name: Run self assign job runs-on: ubuntu-latest steps: diff --git a/.github/workflows/canary-integration-suite.yml b/.github/workflows/canary-integration-suite.yml index b13ad4f49..731d50fcd 100644 --- a/.github/workflows/canary-integration-suite.yml +++ b/.github/workflows/canary-integration-suite.yml @@ -24,6 +24,9 @@ concurrency: group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.head_ref || github.sha }} cancel-in-progress: true +permissions: + contents: read + jobs: canary-tests: uses: ./.github/workflows/canary-integration-test.yml diff --git a/.github/workflows/create-tag.yaml b/.github/workflows/create-tag.yaml deleted file mode 100644 index 22152eac7..000000000 --- a/.github/workflows/create-tag.yaml +++ /dev/null @@ -1,42 +0,0 @@ -name: Tag -on: - workflow_dispatch: - inputs: - version: - description: "Release version (e.g. v1.7.0)" - required: true - -defaults: - run: - # reference: https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#using-a-specific-shell - shell: bash --noprofile --norc -eo pipefail -x {0} - -jobs: - Create-Tag: - runs-on: ubuntu-22.04 - if: github.repository == 'rook/rook' && contains('travisn,leseb,BlaineEXE,jbw976,galexrt,satoru-takeuchi', github.actor) - steps: - - name: checkout - uses: actions/checkout@v4 - with: - fetch-depth: 0 - - - name: set env - run: | - echo "FROM_BRANCH=${GITHUB_REF##*/}" >> $GITHUB_ENV - echo "TO_TAG=$(git describe --abbrev=0 --tags)" >> $GITHUB_ENV - echo "GITHUB_USER=rook" >> $GITHUB_ENV - - - name: Create Tag - uses: negz/create-tag@v1 - with: - version: ${{ github.event.inputs.version }} - token: ${{ secrets.GITHUB_TOKEN }} - - - name: Get Release Note - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - GITHUB_USER: ${{ env.GITHUB_USER }} - FROM_BRANCH: ${{ env.FROM_BRANCH }} - TO_TAG: ${{ env.TO_TAG }} - run: tests/scripts/gen_release_notes.sh diff --git a/.github/workflows/daily-nightly-jobs.yml b/.github/workflows/daily-nightly-jobs.yml index 4fa73a4ed..393c58544 100644 --- a/.github/workflows/daily-nightly-jobs.yml +++ b/.github/workflows/daily-nightly-jobs.yml @@ -9,6 +9,9 @@ defaults: # reference: https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#using-a-specific-shell shell: bash --noprofile --norc -eo pipefail -x {0} +permissions: + contents: read + jobs: canary-arm64: runs-on: [self-hosted, ubuntu-20.04-arm64, ARM64] diff --git a/.github/workflows/integration-test-helm-suite.yaml b/.github/workflows/integration-test-helm-suite.yaml index 125eb646c..515e0c852 100644 --- a/.github/workflows/integration-test-helm-suite.yaml +++ b/.github/workflows/integration-test-helm-suite.yaml @@ -18,6 +18,9 @@ concurrency: group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.head_ref || github.sha }} cancel-in-progress: true +permissions: + contents: read + jobs: TestCephHelmSuite: if: ${{ github.event_name == 'pull_request' && github.ref != 'refs/heads/master' && !contains(github.event.pull_request.labels.*.name, 'skip-ci') }} diff --git a/.github/workflows/integration-test-mgr-suite.yaml b/.github/workflows/integration-test-mgr-suite.yaml index 0fcf2750e..ab53093ea 100644 --- a/.github/workflows/integration-test-mgr-suite.yaml +++ b/.github/workflows/integration-test-mgr-suite.yaml @@ -17,6 +17,9 @@ concurrency: group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.head_ref || github.sha }} cancel-in-progress: true +permissions: + contents: read + jobs: TestCephMgrSuite: runs-on: ubuntu-22.04 diff --git a/.github/workflows/integration-test-multi-cluster-suite.yaml b/.github/workflows/integration-test-multi-cluster-suite.yaml index 0badaee61..be6bf74a7 100644 --- a/.github/workflows/integration-test-multi-cluster-suite.yaml +++ b/.github/workflows/integration-test-multi-cluster-suite.yaml @@ -18,6 +18,9 @@ concurrency: group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.head_ref || github.sha }} cancel-in-progress: true +permissions: + contents: read + jobs: TestCephMultiClusterDeploySuite: if: ${{ github.event_name == 'pull_request' && github.ref != 'refs/heads/master' && !contains(github.event.pull_request.labels.*.name, 'skip-ci') }} diff --git a/.github/workflows/integration-test-object-suite.yaml b/.github/workflows/integration-test-object-suite.yaml index 1754fd5c8..ac0757158 100644 --- a/.github/workflows/integration-test-object-suite.yaml +++ b/.github/workflows/integration-test-object-suite.yaml @@ -18,6 +18,9 @@ concurrency: group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.head_ref || github.sha }} cancel-in-progress: true +permissions: + contents: read + jobs: TestCephObjectSuite: if: ${{ github.event_name == 'pull_request' && github.ref != 'refs/heads/master' && !contains(github.event.pull_request.labels.*.name, 'skip-ci') }} diff --git a/.github/workflows/integration-test-smoke-suite.yaml b/.github/workflows/integration-test-smoke-suite.yaml index 67b4808cb..a458ce7b3 100644 --- a/.github/workflows/integration-test-smoke-suite.yaml +++ b/.github/workflows/integration-test-smoke-suite.yaml @@ -18,6 +18,9 @@ concurrency: group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.head_ref || github.sha }} cancel-in-progress: true +permissions: + contents: read + jobs: TestCephSmokeSuite: if: ${{ github.event_name == 'pull_request' && github.ref != 'refs/heads/master' && !contains(github.event.pull_request.labels.*.name, 'skip-ci') }} diff --git a/.github/workflows/integration-test-upgrade-suite.yaml b/.github/workflows/integration-test-upgrade-suite.yaml index 07ccb01d2..679b9e82d 100644 --- a/.github/workflows/integration-test-upgrade-suite.yaml +++ b/.github/workflows/integration-test-upgrade-suite.yaml @@ -18,6 +18,9 @@ concurrency: group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.head_ref || github.sha }} cancel-in-progress: true +permissions: + contents: read + jobs: TestCephUpgradeSuite: if: ${{ github.event_name == 'pull_request' && github.ref != 'refs/heads/master' && !contains(github.event.pull_request.labels.*.name, 'skip-ci') }} diff --git a/.github/workflows/integration-tests-on-release.yaml b/.github/workflows/integration-tests-on-release.yaml index 067fd28bd..63b3f9bb1 100644 --- a/.github/workflows/integration-tests-on-release.yaml +++ b/.github/workflows/integration-tests-on-release.yaml @@ -12,6 +12,9 @@ defaults: # reference: https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#using-a-specific-shell shell: bash --noprofile --norc -eo pipefail -x {0} +permissions: + contents: read + jobs: TestCephHelmSuite: runs-on: ubuntu-22.04 diff --git a/.github/workflows/multus.yaml b/.github/workflows/multus.yaml index a24a6289b..18955b1f9 100644 --- a/.github/workflows/multus.yaml +++ b/.github/workflows/multus.yaml @@ -22,6 +22,9 @@ concurrency: group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.head_ref || github.sha }} cancel-in-progress: true +permissions: + contents: read + jobs: test-validation-tool: runs-on: ubuntu-latest