Skip to content

add missing top-level token permissions to workflows#1566

Merged
spencerschrock merged 1 commit into
ossf:mainfrom
timothyklee:tklee/top-level-token-permissions
Jul 24, 2025
Merged

add missing top-level token permissions to workflows#1566
spencerschrock merged 1 commit into
ossf:mainfrom
timothyklee:tklee/top-level-token-permissions

Conversation

@timothyklee

@timothyklee timothyklee commented Jul 23, 2025

Copy link
Copy Markdown
Contributor

Improve the Token Permissions score, see https://scorecard.dev/viewer/?uri=github.com/ossf/scorecard-action

Reason
detected GitHub workflow tokens with excessive permissions
Details
Info: jobLevel 'actions' permission set to 'read': .github/workflows/codeql-analysis.yml:28
Info: jobLevel 'contents' permission set to 'read': .github/workflows/codeql-analysis.yml:29
Warn: jobLevel 'packages' permission set to 'write': .github/workflows/ghcr-retention.yml:13
Warn: no topLevel permission defined: .github/workflows/codeql-analysis.yml:1
Info: topLevel 'contents' permission set to 'read': .github/workflows/dependency-review.yml:27
Warn: no topLevel permission defined: .github/workflows/docker-image.yml:1
Info: found token with 'none' permissions: .github/workflows/ghcr-retention.yml:1
Info: topLevel 'contents' permission set to 'read': .github/workflows/ghcr.yml:13
Info: topLevel 'contents' permission set to 'read': .github/workflows/golangci.yml:9
Info: topLevel permissions set to 'read-all': .github/workflows/scorecards.yml:6
Info: topLevel permissions set to 'read-all': .github/workflows/tests.yaml:8

@timothyklee
timothyklee force-pushed the tklee/top-level-token-permissions branch from cc92f86 to c74d0e9 Compare July 23, 2025 21:26
spencerschrock
spencerschrock approved these changes Jul 24, 2025
View reviewed changes

@spencerschrock spencerschrock left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks!

@spencerschrock
spencerschrock merged commit f35c645 into ossf:main Jul 24, 2025
9 checks passed
@timothyklee

timothyklee commented Jul 24, 2025

Copy link
Copy Markdown
Contributor Author

Thanks for merging @spencerschrock , looks like https://github.com/ossf/scorecard-action/actions/workflows/scorecards.yml needs to get manually run for score to get updated.

This was referenced Oct 6, 2025
Merged
Merged
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@spencerschrock spencerschrock spencerschrock approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@timothyklee @spencerschrock