298977887/lede
1
0
Fork 0
mirror of https://github.com/coolsnowwolf/lede.git synced 2025-04-16 04:13:31 +00:00
Code Issues Packages Projects Releases Wiki Activity

github workflows: security hardening

Browse Source 
This PR adds explicit permissions section to workflows. This is a security
best practice because by default workflows run with extended set of permissions
(except from on: pull_request from external forks). By specifying any permission
explicitly all others are set to none. By using the principle of least privilege
the damage a compromised workflow can do (because of an injection or compromised
third party tool or action) is restricted. It is recommended to have most strict
permissions on the top level and grant write permissions on job level case by case.
This commit is contained in:
Alex 2022-08-29 20:33:26 +01:00 committed by AmadeusGhost
parent 1ccc3bfd54
commit 4e90e9afc8
1 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
.github/workflows/openwrt-ci.yml vendored
View File

@ -13,10 +13,16 @@ on:
release: release:
types: [published] types: [published]
permissions:
contents: read
jobs: jobs:
build_openwrt: build_openwrt:
permissions:
contents: write # for release creation
name: Build OpenWrt firmware name: Build OpenWrt firmware
runs-on: ubuntu-latest runs-on: ubuntu-latest