Skip to content
This repository has been archived by the owner on Feb 22, 2024. It is now read-only.

🔐 Reduce permissions in documentation.yml workflow #208

Merged
merged 2 commits into from
Oct 18, 2023
Merged

🔐 Reduce permissions in documentation.yml workflow #208

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
4f47ba8
🔥 Remove permissions from documentation.yml workflow
connormaglynn Oct 17, 2023
05b6f72
✨ Add minimal permissions for `documentation.yml` workflow to run
connormaglynn Oct 17, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 14 additions & 10 deletions .github/workflows/documentation.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,18 +5,22 @@ on:
branches:
- main

permissions: { }
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The checkgov issue didn't like the default permissions, setting these removes them all

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Does it still use the default permissions?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Removes all the permissions (REF)

You can use the following syntax to disable permissions for all of the available scopes:
permissions: {}

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This action writes to pull requests so you will need a minimum of:

permissions:
   contents: read
   pull_request: write

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@jakemulley turns out it's

permissions:
   contents: write

Since you need contents: write to write to a file and pull_request:write is for data on the PR such as labels, assignees, reviewers, comments etc. (REF)


jobs:
docs:
runs-on: ubuntu-latest
permissions:
contents: write
steps:
- uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
with:
ref: ${{ github.event.pull_request.head.ref }}
- uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
with:
ref: ${{ github.event.pull_request.head.ref }}

- name: Render terraform docs and push changes back to PR
uses: terraform-docs/gh-actions@f6d59f89a280fa0a3febf55ef68f146784b20ba0 # v1.0.0
with:
working-dir: .
output-file: README.md
output-method: inject
git-push: "true"
- name: Render terraform docs and push changes back to PR
uses: terraform-docs/gh-actions@f6d59f89a280fa0a3febf55ef68f146784b20ba0 # v1.0.0
with:
working-dir: .
output-file: README.md
output-method: inject
git-push: "true"
Loading