OpenZeppelin / OpenZeppelin/compact-tools
Move write permissions in `release.yml` to jobs that need the permissions
Open
Beginner friendly
Nobody has claimed this yet.
github_actions
- Dominant language
- TypeScript
- Stars
- 4
- Forks
- 5
- Avg merge
- 15h 28m
- Merged PRs (30d)
- 31
Description
We can improve the security of our release Github action by moving write permissions to the jobs that need them rather than applying the write permission to all jobs in the workflow. See https://github.com/OpenZeppelin/compact-tools/pull/19#discussion_r2566771668 for context
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with .github/workflows/release.yml and read the discussion in PR #19 linked by the issue. Identify which jobs require write permissions, move those permissions to the relevant job definitions, and verify that other jobs retain only the permissions they need.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- github-actions
- Domain
- ci-cd, security
- Issue type
- Refactor
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 65/100