GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — GitHub Workflows security hardening by sashashura · Pull Request #96492 · python/cpython

Conversation

@sashashura

@sashashura sashashura commented Sep 1, 2022

Copy link
Copy Markdown
Contributor

This PR adds explicit permissions section to workflows. This is a security best practice because by default workflows run with extended set of permissions (except from on: pull_request from external forks). By specifying any permission explicitly all others are set to none. By using the principle of least privilege the damage a compromised workflow can do (because of an injection or compromised third party tool or action) is restricted.
It is recommended to have most strict permissions on the top level and grant write permissions on job level case by case.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
ezio-melotti reacted with eyes emoji
All reactions
  • 👀 1 reaction
@sashashura
Update project-updater.yml
9b91bad 
Signed-off-by: sashashura <[email protected]>
@ghost

ghost commented Sep 1, 2022 •
edited by ghost
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown

All commit authors signed the Contributor License Agreement.
CLA signed
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-bot bedevere-bot added the awaiting review label Sep 1, 2022
@bedevere-bot

bedevere-bot commented Sep 1, 2022

Copy link
Copy Markdown

Most changes to Python require a NEWS entry.

Please add it using the blurb_it web app or the blurb command-line tool.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@sashashura

sashashura commented Sep 1, 2022 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Contributor Author

Most changes to Python require a NEWS entry.

Please add it using the blurb_it web app or the blurb command-line tool.

I believe it is a building infrastructure change only and doesn't require NEWS entry.
Also it is a trivial change, so issue number is not needed.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@AlexWaygood AlexWaygood added skip news skip issue labels Sep 1, 2022
@kumaraditya303
kumaraditya303 requested review from ambv and ewdurbin September 4, 2022 06:20
@matthiasgoergens

matthiasgoergens commented Sep 6, 2022

Copy link
Copy Markdown
Contributor

Would this ever cause any problem to non-malicious users?
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@sashashura

sashashura commented Sep 6, 2022

Copy link
Copy Markdown
Contributor Author

Would this ever cause any problem to non-malicious users?

In this case it is more about potential supply chain - what damage can be done by running build tool or action if it is ever compromised. Like not running with sudo unnecessarily.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@sashashura

sashashura commented Sep 20, 2022

Copy link
Copy Markdown
Contributor Author

Please let me know if you have any questions.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@sashashura
Update project-updater.yml
044420f 
repository-projects: write is not needed because a separate secrets.ADD_TO_PROJECT_PAT is used
@sashashura

sashashura commented Sep 22, 2022

Copy link
Copy Markdown
Contributor Author

Just for the reference these are the current permissions:

image
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@matthiasgoergens

matthiasgoergens commented Sep 23, 2022

Copy link
Copy Markdown
Contributor

For what it's worth, I think this is very worthwhile. +1 from me!

Alas, I have no authority to approve anything. Not sure how you can get the attention from someone who does?
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@JelleZijlstra
JelleZijlstra requested a review from ezio-melotti October 7, 2022 16:47
@ezio-melotti ezio-melotti self-assigned this Oct 7, 2022
ezio-melotti
ezio-melotti approved these changes Oct 8, 2022
View reviewed changes
@bedevere-bot bedevere-bot added awaiting merge and removed awaiting review labels Oct 8, 2022
@ezio-melotti
ezio-melotti merged commit c66dbdd into python:main Oct 8, 2022
@bedevere-bot bedevere-bot removed the awaiting merge label Oct 8, 2022
@ezio-melotti

ezio-melotti commented Oct 8, 2022

Copy link
Copy Markdown
Member

I tested this in https://github.com/python/cpython/actions/runs/3209712807 after merging and verified that it still works. Thanks for the PR!
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
carljm added a commit to carljm/cpython that referenced this pull request Oct 8, 2022
@carljm
Merge branch 'main' into typewatch
d67d6fd 
* main:
  pythongh-68686: Retire eptag ptag scripts (python#98064)
  pythongh-97922: Run the GC only on eval breaker (python#97920)
  GitHub Workflows security hardening (python#96492)
  Add `@ezio-melotti` as codeowner for `.github/`. (python#98079)
  pythongh-97913 Docs: Add walrus operator to the index (python#97921)
  [doc] Fix broken links to C extensions accelerating stdlib modules (python#96914)
  pythongh-97822: Fix http.server documentation reference to test() function (python#98027)
  pythongh-91052: Add PyDict_Unwatch for unwatching a dictionary (python#98055)
  pythonGH-98023: Change default child watcher to PidfdChildWatcher on supported systems (python#98024)
  pythonGH-94182: Run the PidfdChildWatcher on the running loop (python#94184)
carljm added a commit to carljm/cpython that referenced this pull request Oct 9, 2022
@carljm
Merge branch 'main' into urllibnonet
132c32e 
* main: (5519 commits)
  Minor edits to the Descriptor HowTo Guide (pythonGH-24901)
  Fix link to Lifecycle of a Pull Request in CONTRIBUTING (python#98102)
  pythonGH-94597: deprecate `SafeChildWatcher`, `FastChildWatcher` and `MultiLoopChildWatcher` child watchers  (python#98089)
  Auto-cancel old builds when new commit pushed to branch (python#98009)
  pythongh-95011: Migrate syslog module to Argument Clinic (pythonGH-95012)
  pythongh-68686: Retire eptag ptag scripts (python#98064)
  pythongh-97922: Run the GC only on eval breaker (python#97920)
  GitHub Workflows security hardening (python#96492)
  Add `@ezio-melotti` as codeowner for `.github/`. (python#98079)
  pythongh-97913 Docs: Add walrus operator to the index (python#97921)
  [doc] Fix broken links to C extensions accelerating stdlib modules (python#96914)
  pythongh-97822: Fix http.server documentation reference to test() function (python#98027)
  pythongh-91052: Add PyDict_Unwatch for unwatching a dictionary (python#98055)
  pythonGH-98023: Change default child watcher to PidfdChildWatcher on supported systems (python#98024)
  pythonGH-94182: Run the PidfdChildWatcher on the running loop (python#94184)
  pythongh-92886: make test_ast pass with -O (assertions off) (pythonGH-98058)
  pythongh-92886: make test_coroutines pass with -O (assertions off) (pythonGH-98060)
  pythongh-57179: Add note on symlinks for os.walk (python#94799)
  pythongh-94808: Fix regex on exotic platforms (python#98036)
  pythongh-90085: Remove vestigial -t and -c timeit options (python#94941)
  ...
mpage pushed a commit to mpage/cpython that referenced this pull request Oct 11, 2022
@sashashura @mpage
GitHub Workflows security hardening (python#96492)
b31a5ee 
* Update project-updater.yml

Signed-off-by: sashashura <[email protected]>

* Update project-updater.yml

repository-projects: write is not needed because a separate secrets.ADD_TO_PROJECT_PAT is used

Signed-off-by: sashashura <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ezio-melotti ezio-melotti ezio-melotti approved these changes
@ambv ambv Awaiting requested review from ambv
@ewdurbin ewdurbin Awaiting requested review from ewdurbin

Uh oh!

There was an error while loading. Please reload this page.

Assignees

@ezio-melotti ezio-melotti

Labels

skip issue skip news

Projects

CPython labels
Status: Done
Sprint
Archived in project

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

5 participants

@sashashura @bedevere-bot @matthiasgoergens @ezio-melotti @AlexWaygood
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.