Details
-
Improvement
-
Status: Resolved
-
Major
-
Resolution: Fixed
-
None
-
None
Description
Currently, the GitHub token associated with apache/nifi workflows are elevated. Here is an example of elevated GitHub token:
https://github.com/apache/nifi/actions/runs/3167551611/jobs/5158128990#step:1:19
The token permissions should be adjusted to include only the required permissions.
Motivation and Context
- This is a security best practice, so if the GITHUB_TOKEN is compromised due to a vulnerability or compromised Action, the damage will be reduced.
- GitHub recommends defining minimum GITHUB_TOKEN permissions.
- The Open Source Security Foundation (OpenSSF) Scorecards also treats not setting token permissions as a high-risk issue. This change will help increase the Scorecard score for this repository
Attachments
Issue Links
- links to