Repository navigation
OpenSSF scorecard "Token-permissions" score zero #3012
Description
Hello there 👋,
Today in the Node.js security meeting we discussed that the undici project score had dropped due to a change in the workflows. This seems to be related to the following commit.
- nightly.yml and test.yml seems to lack global permissions
permissions:
contents: read- In nodejs.yml we have warnings to reviews the following permission.
undici/.github/workflows/nodejs.yml
Lines 102 to 105 in d3d24e2
Github Action Merge Dependabot require pull-requests and contents (not sure if actions is required). These warnings are perhaps to be ignored.
@nodejs/security-wg
Reacted by Carlos Fuentes
Activity
[-]OpenSSF scorecard permission[/-][+]OpenSSF scorecard "Token-permissions" score zero[/+]metcoder95 commentedon Mar 28, 2024
#3013 closes this issue?
fraxken commentedon Mar 28, 2024
Not yet. I'm working on nodejs workflow. If everything ok I will close myself (else I will open another PR).
mweberxyz commentedon Mar 28, 2024
My bad on that change. The GHA documentation is a bit bare on permissions, by not setting the global permissions does it essentially issue a full read-write token to the workflow?
Edit: Nvm found it: https://docs.github.com/en/actions/security-guides/automatic-token-authentication
These defaults are crazy permissive.
Also just to confirm: Are job-level permissions additive to workflow-level?
For example, in nightly at the workflow level we now have:
then the report-failure job within that workflow:
So there's no need to explicitly set
contents: readin the report-failure?fraxken commentedon Mar 29, 2024
I think it depend on the Github permission setting (but by default yes it has read-write almost everywhere).
Yes. The basic idea is to set read at the root and then assign the right permission by jobs.
You can read more here about how OpenSSF scorecard build the score (there is also some tips and links).