Skip to content

Commit 08f52e2

Browse files
paulinebmPauline
paulinebm
and
Pauline
authored
permissions worflows fix (#42080)
- add new workflow to scan permissions github_token really need and advise pernmissions - add actions-permissions/monitor on almost all worklows => the goal is to define properly all permissions blocks by jobs # Conflicts: # .github/workflows/check-workflow-permissions.yml Co-authored-by: Pauline <pauline@Paulines-MacBook-Pro-2.local>
1 parent c790403 commit 08f52e2

21 files changed

+153
-12
lines changed

‎.github/workflows/check-workflow-permissions.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,4 +20,4 @@ jobs:
2020
contents: read
2121
with:
2222
workflow_name: ${{ inputs.workflow_name }}
23-
run_count: ${{ fromJSON(inputs.run_count) }}
23+
run_count: ${{ fromJSON(inputs.run_count) }}

‎.github/workflows/get-pr-info.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -87,6 +87,9 @@ jobs:
8787
PR_FILES: ${{ steps.pr_info.outputs.files }}
8888
if: ${{ inputs.pr_number != '' }}
8989
steps:
90+
- uses: GitHubSecurityLab/actions-permissions/monitor@v1
91+
with:
92+
config: ${{ vars.PERMISSIONS_CONFIG }}
9093
- name: Extract PR details
9194
id: pr_info
9295
uses: actions/github-script@v6

‎.github/workflows/get-pr-number.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,9 @@ jobs:
1313
outputs:
1414
PR_NUMBER: ${{ steps.set_pr_number.outputs.PR_NUMBER }}
1515
steps:
16+
- uses: GitHubSecurityLab/actions-permissions/monitor@v1
17+
with:
18+
config: ${{ vars.PERMISSIONS_CONFIG }}
1619
- name: Get PR number
1720
shell: bash
1821
env:

‎.github/workflows/new_model_pr_merged_notification.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,9 @@ jobs:
1313
name: Notify new model
1414
runs-on: ubuntu-22.04
1515
steps:
16+
- uses: GitHubSecurityLab/actions-permissions/monitor@v1
17+
with:
18+
config: ${{ vars.PERMISSIONS_CONFIG }}
1619
- uses: actions/checkout@v4
1720
with:
1821
fetch-depth: 0

‎.github/workflows/pr_build_doc_with_comment.yml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,9 @@ jobs:
3535
PR_MERGE_COMMIT_DATE: ${{ needs.get-pr-info.outputs.PR_MERGE_COMMIT_DATE }}
3636
PR_MERGE_COMMIT_TIMESTAMP: ${{ needs.get-pr-info.outputs.PR_MERGE_COMMIT_TIMESTAMP }}
3737
steps:
38+
- uses: GitHubSecurityLab/actions-permissions/monitor@v1
39+
with:
40+
config: ${{ vars.PERMISSIONS_CONFIG }}
3841
- run: |
3942
COMMENT_TIMESTAMP=$(date -d "${COMMENT_DATE}" +"%s")
4043
echo "COMMENT_DATE: $COMMENT_DATE"
@@ -54,6 +57,9 @@ jobs:
5457
statuses: write
5558
runs-on: ubuntu-22.04
5659
steps:
60+
- uses: GitHubSecurityLab/actions-permissions/monitor@v1
61+
with:
62+
config: ${{ vars.PERMISSIONS_CONFIG }}
5763
- name: Create Run
5864
id: create_run
5965
env:
@@ -77,6 +83,9 @@ jobs:
7783
pull-requests: write
7884
runs-on: ubuntu-22.04
7985
steps:
86+
- uses: GitHubSecurityLab/actions-permissions/monitor@v1
87+
with:
88+
config: ${{ vars.PERMISSIONS_CONFIG }}
8089
- name: Reply to the comment
8190
env:
8291
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -112,6 +121,9 @@ jobs:
112121
GITHUB_RUN_URL: https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}
113122
STATUS_OK: ${{ contains(fromJSON('["skipped", "success"]'), needs.create_run.result) }}
114123
steps:
124+
- uses: GitHubSecurityLab/actions-permissions/monitor@v1
125+
with:
126+
config: ${{ vars.PERMISSIONS_CONFIG }}
115127
- name: Get `build-doc` job status
116128
run: |
117129
echo "${{ needs.build-doc.result }}"

‎.github/workflows/pr_slow_ci_suggestion.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,10 @@ jobs:
2323
outputs:
2424
jobs: ${{ steps.get_jobs.outputs.jobs_to_run }}
2525
steps:
26+
- uses: GitHubSecurityLab/actions-permissions/monitor@v1
27+
with:
28+
config: ${{ vars.PERMISSIONS_CONFIG }}
29+
2630
# This checkout to the main branch
2731
- uses: actions/checkout@v4
2832
with:
@@ -89,6 +93,10 @@ jobs:
8993
pull-requests: write
9094
runs-on: ubuntu-22.04
9195
steps:
96+
- uses: GitHubSecurityLab/actions-permissions/monitor@v1
97+
with:
98+
config: ${{ vars.PERMISSIONS_CONFIG }}
99+
92100
- name: Check and update comment if needed
93101
uses: actions/github-script@v7
94102
env:

‎.github/workflows/push-important-models.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,10 @@ jobs:
1111
outputs:
1212
matrix: ${{ steps.set-matrix.outputs.matrix }}
1313
steps:
14+
- uses: GitHubSecurityLab/actions-permissions/monitor@v1
15+
with:
16+
config: ${{ vars.PERMISSIONS_CONFIG }}
17+
1418
- name: Check out code
1519
uses: actions/checkout@v4
1620

‎.github/workflows/release-conda.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,10 @@ jobs:
1818
shell: bash -l {0}
1919

2020
steps:
21+
- uses: GitHubSecurityLab/actions-permissions/monitor@v1
22+
with:
23+
config: ${{ vars.PERMISSIONS_CONFIG }}
24+
2125
- name: Checkout repository
2226
uses: actions/checkout@v4
2327

‎.github/workflows/self-comment-ci.yml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,10 @@ jobs:
4646
PR_HEAD_SHA: ${{ needs.get-pr-info.outputs.PR_HEAD_SHA }}
4747
PR_MERGE_SHA: ${{ needs.get-pr-info.outputs.PR_MERGE_COMMIT_SHA }}
4848
steps:
49+
- uses: GitHubSecurityLab/actions-permissions/monitor@v1
50+
with:
51+
config: ${{ vars.PERMISSIONS_CONFIG }}
52+
4953
- name: Verify `merge_commit` timestamp is older than the issue comment timestamp
5054
env:
5155
COMMENT_DATE: ${{ github.event.comment.created_at }}
@@ -67,6 +71,10 @@ jobs:
6771
models: ${{ steps.models_to_run.outputs.models }}
6872
quantizations: ${{ steps.models_to_run.outputs.quantizations }}
6973
steps:
74+
- uses: GitHubSecurityLab/actions-permissions/monitor@v1
75+
with:
76+
config: ${{ vars.PERMISSIONS_CONFIG }}
77+
7078
- uses: actions/checkout@v4
7179
with:
7280
fetch-depth: "0"
@@ -109,6 +117,10 @@ jobs:
109117
pull-requests: write
110118
runs-on: ubuntu-22.04
111119
steps:
120+
- uses: GitHubSecurityLab/actions-permissions/monitor@v1
121+
with:
122+
config: ${{ vars.PERMISSIONS_CONFIG }}
123+
112124
- name: Reply to the comment
113125
env:
114126
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -131,6 +143,10 @@ jobs:
131143
pull-requests: write
132144
runs-on: ubuntu-22.04
133145
steps:
146+
- uses: GitHubSecurityLab/actions-permissions/monitor@v1
147+
with:
148+
config: ${{ vars.PERMISSIONS_CONFIG }}
149+
134150
- name: Reply to the comment
135151
env:
136152
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -152,6 +168,10 @@ jobs:
152168
statuses: write
153169
runs-on: ubuntu-22.04
154170
steps:
171+
- uses: GitHubSecurityLab/actions-permissions/monitor@v1
172+
with:
173+
config: ${{ vars.PERMISSIONS_CONFIG }}
174+
155175
- name: Create Run
156176
id: create_run
157177
env:
@@ -210,6 +230,10 @@ jobs:
210230
if: ${{ always() && needs.create_run.result == 'success' }}
211231
runs-on: ubuntu-22.04
212232
steps:
233+
- uses: GitHubSecurityLab/actions-permissions/monitor@v1
234+
with:
235+
config: ${{ vars.PERMISSIONS_CONFIG }}
236+
213237
- name: Show reports from jobs
214238
env:
215239
MODEL_REPORT: ${{ needs.model-ci.outputs.report }}

‎.github/workflows/self-nightly-caller.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,10 @@ jobs:
3030
name: Setup
3131
runs-on: ubuntu-22.04
3232
steps:
33+
- uses: GitHubSecurityLab/actions-permissions/monitor@v1
34+
with:
35+
config: ${{ vars.PERMISSIONS_CONFIG }}
36+
3337
- name: Setup
3438
run: |
3539
mkdir "setup_values"

0 commit comments

Comments
 (0)