github / github/GreenSoftwareDirectory

Please define actions workflow permissions

未关闭
#45 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看
主要语言
没有语言数据
星标
926
派生
140
PR 合并指标
30 天内没有已合并 PR

描述

## Workflow permissions improvement

There are **1 workflow file** that are currently lacking explicit permissions

### Affected Workflow Files

The following workflow files need permissions to be explicitly defined:

- [`.github/workflows/links_checkerPR.yml`](https://github.com/github/GreenSoftwareDirectory/blob/main/.github/workflows/links_checkerPR.yml)

### Request

Ensure permissions are explicitly defined. Below are Copilot prompts/instructions if you would like Copilot's assistance with addressing this.

## GitHub Copilot Assignment Prompts and Context

**Task**: Add explicit permissions to GitHub Actions workflow files that are currently missing them.

**Scope**: Update the workflow files listed above to include appropriate `permissions:` blocks.

**Analysis Methodology**:
1. **Gather Current State**: Check if the workflow has any existing permissions defined
2. **Inventory Workflow Actions**:
- Actions performed directly by the workflow
- API calls made by the workflow
- External actions included via `uses:` statements
3. **Determine Required Permissions**: Map each action to its minimum required permissions
4. **Synthesize Minimal Permissions**: Create permissions block with only necessary permissions

**Requirements**:
1. Add a `permissions:` block to each workflow file that doesn't have one
2. Start with `contents: read` as the minimum permission
3. Add additional permissions only if the workflow actually needs them based on the actions it performs
4. Place the `permissions:` block at the job level or workflow level as appropriate
5. Ensure the syntax is correct and follows YAML formatting
6. Maintain existing content formatting, including indentation and comments

**Files to modify**: See the list of affected workflow files above.

**Acceptance criteria**:
- [ ] All listed workflow files have explicit permissions defined
- [ ] Permissions follow the principle of least privilege
- [ ] YAML syntax is valid
- [ ] Workflows still function correctly after changes

## Copilot Instructions:

Please create a pull request that adds appropriate `permissions:` blocks to each of the workflow files listed above. Analyze each workflow to determine the minimum permissions required based on the actions it performs, and add only those necessary permissions.

贡献指南

打开贡献指南

调研方向

打开 .github/workflows/links_checkerPR.yml,在决定最小权限之前,盘点其中现有的 jobs、uses: actions 和与 API 相关的步骤。添加一个明确的最小权限 permissions 块,同时保留工作流的格式,然后验证 YAML,并确认该工作流仍满足列出的验收标准。

由索引模型根据 Issue 内容生成。

评估

技术栈
github-actions
领域
ci-cd, security
Issue 类型
功能
难度
2/5
预计耗时
1-3 小时
活跃度
停滞
描述清晰度
描述清楚
新手友好度
58/100

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。