kubernetes-sigs / kubernetes-sigs/controller-runtime
Backport workflow-hardening fix (excessive-permissions) to 5 release branches
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 3k
- Forks
- 1.3k
- Avg merge
- 2d 5h
- Merged PRs (30d)
- 14
Description
Summary
The default branch already hardened .github/workflows/verify.yml against the issue(s) below, but 5 release branches still carry it. This proposes the same, minimal, scanner-verified fix for each.
What's flagged (by zizmor)
excessive-permissions— workflow/job granted broaderpermissionsthan needed
Already resolved on the default branch in:
Affected release branches (5)
release-0.24(still present as of HEAD4e7b7526)release-0.21(still present as of HEAD7fd020cb)release-0.22(still present as of HEADa19ec76a)release-0.19(still present as of HEAD5fe7bb3e)release-0.20(still present as of HEAD32e5e9e9)
Suggested per-branch patches
Each diff below was checked locally with zizmor and actionlint: the flagged finding(s) are cleared on the affected construct and no new lint or security findings are introduced. (Whitespace is normalized; only security-relevant lines change.)
release-0.24 — excessive-permissions
File .github/workflows/verify.yml; suggested edits:
-
- permissions.checks = 'write'
--- a/.github/workflows/verify.yml
+++ b/.github/workflows/verify.yml
@@ -16,3 +16,5 @@
PR_TITLE: ${{ github.event.pull_request.title }}
run: |
./hack/verify-pr-title.sh "${PR_TITLE}"
+permissions:
+ checks: write
release-0.21 — excessive-permissions
File .github/workflows/verify.yml; suggested edits:
-
- permissions.checks = 'write'
--- a/.github/workflows/verify.yml
+++ b/.github/workflows/verify.yml
@@ -16,3 +16,5 @@
PR_TITLE: ${{ github.event.pull_request.title }}
run: |
./hack/verify-pr-title.sh "${PR_TITLE}"
+permissions:
+ checks: write
release-0.22 — excessive-permissions
File .github/workflows/verify.yml; suggested edits:
-
- permissions.checks = 'write'
--- a/.github/workflows/verify.yml
+++ b/.github/workflows/verify.yml
@@ -16,3 +16,5 @@
PR_TITLE: ${{ github.event.pull_request.title }}
run: |
./hack/verify-pr-title.sh "${PR_TITLE}"
+permissions:
+ checks: write
release-0.19 — excessive-permissions
File .github/workflows/verify.yml; suggested edits:
-
- permissions.checks = 'write'
--- a/.github/workflows/verify.yml
+++ b/.github/workflows/verify.yml
@@ -16,3 +16,5 @@
PR_TITLE: ${{ github.event.pull_request.title }}
run: |
./hack/verify-pr-title.sh "${PR_TITLE}"
+permissions:
+ checks: write
release-0.20 — excessive-permissions
File .github/workflows/verify.yml; suggested edits:
-
- permissions.checks = 'write'
--- a/.github/workflows/verify.yml
+++ b/.github/workflows/verify.yml
@@ -16,3 +16,5 @@
PR_TITLE: ${{ github.event.pull_request.title }}
run: |
./hack/verify-pr-title.sh "${PR_TITLE}"
+permissions:
+ checks: write
Happy to open pull requests instead if that's preferred.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Compare .github/workflows/verify.yml on release-0.24, release-0.21, release-0.22, release-0.19, and release-0.20 with the default-branch fix. Check each branch using zizmor and actionlint; done means the excessive-permissions finding is cleared without new findings on all five branches.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- github-actions
- Domain
- ci-cd, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 78/100