starred/netbox
1
0
Fork 0
mirror of https://github.com/netbox-community/netbox.git synced 2026-01-11 21:10:29 +01:00
Code Issues 273 Packages Projects Releases 10 Wiki Activity

Add minimum GitHub token permissions for workflows #6963

New Issue
Closed
opened 2025-12-29 19:47:13 +01:00 by adam · 1 comment
adam commented 2025-12-29 19:47:13 +01:00
Owner
Copy Link

Originally created by @varunsh-coder on GitHub (Sep 10, 2022).

Proposed Changes

GitHub Actions workflows have a GITHUB_TOKEN with write access to multiple scopes.
Here is an example of the permissions in one of the workflows:
https://github.com/netbox-community/netbox/runs/8282051373?check_suite_focus=true#step:1:19

Proposal is to set minimum token permissions, so the scopes will be reduced to the minimum needed for each workflow.
I have the PR ready to be submitted. If you can assign this issue to me, I can submit the PR.
Here is the commit:
0eebe4a5f8

Justification

Motivation and Context

Originally created by @varunsh-coder on GitHub (Sep 10, 2022). ### Proposed Changes GitHub Actions workflows have a GITHUB_TOKEN with `write` access to multiple scopes. Here is an example of the permissions in one of the workflows: https://github.com/netbox-community/netbox/runs/8282051373?check_suite_focus=true#step:1:19 Proposal is to set minimum token permissions, so the scopes will be reduced to the minimum needed for each workflow. I have the PR ready to be submitted. If you can assign this issue to me, I can submit the PR. Here is the commit: https://github.com/netbox-community/netbox/commit/0eebe4a5f8727e3a3168f34a492834eb9c637a75 ### Justification ### Motivation and Context - This is a security best practice, so if the GITHUB_TOKEN is compromised due to a vulnerability or compromised Action, the damage will be reduced. - GitHub recommends defining minimum GITHUB_TOKEN permissions. https://docs.github.com/en/actions/security-guides/automatic-token-authentication#modifying-the-permissions-for-the-github_token - The Open Source Security Foundation (OpenSSF) [Scorecards](https://github.com/ossf/scorecard) also treats not setting token permissions as a high-risk issue. This change will help increase the Scorecard score for this repository.
adam added the status: acceptedtype: housekeeping labels 2025-12-29 19:47:13 +01:00
adam closed this issue 2025-12-29 19:47:13 +01:00
adam commented 2025-12-29 19:47:14 +01:00
Author
Owner
Copy Link

@jeremystretch commented on GitHub (Sep 29, 2022):

Thanks for identifying this, @varunsh-coder. It looks like @sashashura has a suitable PR already (#10456) so I'm going to merge that.

Also, I've changed the repo's default workflow permissions from permissive to restrictive.

@jeremystretch commented on GitHub (Sep 29, 2022): Thanks for identifying this, @varunsh-coder. It looks like @sashashura has a suitable PR already (#10456) so I'm going to merge that. Also, I've changed the repo's default workflow permissions from permissive to restrictive.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
beta
breaking change
complexity: high
complexity: low
complexity: medium
needs milestone
netbox
pending closure
plugin candidate
pull-request
Mirrored from GitHub Pull Request
 severity: high
severity: low
severity: medium
status: accepted
status: backlog
status: blocked
status: duplicate
status: needs owner
status: needs triage
status: revisions needed
status: under review
topic: GraphQL
topic: Internationalization
topic: OpenAPI
topic: UI/UX
topic: cabling
topic: event rules
topic: htmx navigation
topic: industrialization
topic: migrations
topic: plugins
topic: scripts
topic: templating
topic: testing
type: bug
type: deprecation
type: documentation
type: feature
type: housekeeping
type: translation
No Label status: accepted type: housekeeping
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/netbox#6963
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?