actions / actions/deploy-pages
More clarity on id-token: write
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 953
- Forks
- 143
- Avg merge
- 35m
- Merged PRs (30d)
- 1
Description
The README includes this comment: https://github.com/actions/deploy-pages/blob/d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e/README.md?plain=1#L32
Could we get more information on this?
It looks pretty scary. id-token: write implies that there is some deep and mysterious extra permission being granted to this workflow, potentially involving the ability to make writes and involving a token which might have permission to do other privileged things, maybe even at the account or organization level.
It's really hard to figure out the security impact of this configuration from existing GitHub documentation.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the README comment at the linked line around line 32 and review the existing GitHub documentation referenced by the issue. Clarify what id-token: write permits and its security impact in the README, with wording that addresses whether it grants broader write or account-level privileges.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- github-actions
- Domain
- documentation, security
- Issue type
- Documentation
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100