PDP-1182 SECCMP-1797: Add top-level permissions to restrict default token#1070
Conversation
MLE-26608 Release MarkLogic Node Client API 4.1.0
Adds explicit top-level permissions: contents: read to limit the default GITHUB_TOKEN scope for all jobs. Individual jobs that need write access (copyright-validation) already declare their own permissions block which overrides the default. This follows the principle of least privilege recommended in GitHub's PwnRequest security guidance.
GAdityaVarma
requested review from
BillFarber,
anu3990,
rjrudin and
stevebio
as code owners
There was a problem hiding this comment.
Pull request overview
Updates the repository’s pull_request_target workflow to reduce the default GITHUB_TOKEN scope at the workflow level, limiting inherited permissions across jobs.
Changes:
- Adds workflow-level
permissions: contents: readto restrict the default token scope. - Keeps job-level permission overrides for the
copyright-validationjob.
| @@ -1,18 +1,17 @@ | |||
| name: PR Workflow | |||
|
|
|||
| on: | |||
There was a problem hiding this comment.
The rationale for using pull_request_target (especially for fork PRs) was removed. Since this event has important security implications, consider keeping a brief comment explaining why pull_request_target is required here and what safeguards are assumed (e.g., no checkout of untrusted code).
| on: | |
| on: | |
| # Use pull_request_target so these checks can run for fork PRs in the base | |
| # repository context. This workflow is expected to remain metadata-only: | |
| # it should not check out or execute untrusted PR code, and should only | |
| # pass PR metadata to trusted reusable workflows. |
| jira-pr-check: | ||
| name: 🏷️ Validate JIRA ticket ID | ||
| # Use the reusable workflow from the central repository | ||
| uses: marklogic/pr-workflows/.github/workflows/jira-id-check.yml@main |
There was a problem hiding this comment.
Reusable workflows are referenced by a mutable branch (@main) here (and also in the copyright-validation job below). For supply-chain security—especially with pull_request_target—pin reusable workflows to a specific commit SHA or a trusted, immutable tag to prevent unexpected upstream changes being pulled into this workflow.
GAdityaVarma
changed the title
|
Copyright Validation Results ❌ Failed Files
⏭️ Skipped (Excluded) Files
🛠️ GuidanceFollow these steps to fix the failed files:
|
|
@GAdityaVarma We can remove this workflow from this repository |
SECCMP-1797: Add top-level permissions to restrict default token
Adds
permissions: contents: readat the workflow level to restrict the default GITHUB_TOKEN scope. Without this, all jobs inherit the fullpull_request_targetwrite token.The
copyright-validationjob already declares its ownpermissionsblock which overrides the default for that specific job.Ref: Preventing pwn requests