🌱 harden git workflows#2512
Conversation
PrashantR30
requested review from
cdesiniotis,
karthikvetrivel,
rahulait,
rajathagasthya,
shivamerla and
tariq1890
as code owners
PrashantR30
force-pushed
the
main
branch
3 times, most recently
from
0936b38 to
c53cfa8
Compare
|
Thanks @PrashantR30 for this change. Is there a specific reason why a subset of workflows were updated? For example, coverage.yaml, release-images-list.yaml, etc were not touched. |
PrashantR30
force-pushed
the
main
branch
4 times, most recently
from
0ada2f6 to
fdce937
Compare
PrashantR30
force-pushed
the
main
branch
5 times, most recently
from
af39373 to
27c9873
Compare
|
/ok to test 27c9873 |
|
@PrashantR30 Please note the following the github actions CI error below
|
|
/ok to test 14a4bdb |
|
@PrashantR30 Can you sign your commits? |
Commit was signed. |
|
Hello @rahulait, @tariq1890 and @rajatchopra , please review. |
PrashantR30
force-pushed
the
main
branch
2 times, most recently
from
2aa6159 to
d136a2f
Compare
Signed-off-by: PrashantR30 <pramhit@mirantis.com>
|
/ok to test b50451e |
|
@rajatchopra can you provide your review as well? |
4 participants
Description
This PR hardens GitHub Actions workflows by disabling persisted Git credentials on checkout steps and explicitly scoping workflow permissions to the minimum required access.
The changes reduce the risk of unintended
GITHUB_TOKENexposure to later workflow steps while preserving existing CI behavior. Workflows that only read repository contents now use read-only permissions, while image publishing workflows keep the required package write permissions.Checklist
actions: writeas the workflow only usesactions/staleto label, comment on, and close issues and does not appear to require permissions to manage workflow runs or other GitHub Actions resources.make lint)make validate-generated-assets)make validate-modules)Testing
Validated the workflow YAML changes manually.
No application code was changed. This PR only updates GitHub Actions workflow configuration for credential and permission hardening, but still we let the test run to validate if the workflow operation works.