mirror of
https://github.com/coder/coder.git
synced 2026-09-24 15:04:27 +08:00
Atif Ali
671173b498
## Summary
Hardens GitHub Actions workflow token permissions to address OpenSSF
Scorecard findings.
## Changes
- Default affected workflows to no token permissions (`permissions:
{}`).
- Move required write permissions directly to the jobs that consume
them.
- Document the least-privilege permissions rule in `AGENTS.md`: never
grant write permissions at the workflow top level; scope grants to
`jobs.<id>.permissions`.
## Validation
- `make lint-light` passed locally via pre-commit hooks.
> 🤖 This PR was created with the help of Coder Agents, and needs a human
review. 🧑💻
25 lines
683 B
YAML
25 lines
683 B
YAML
# Filtering pull requests is much easier when we can reliably guarantee
|
|
# that the "Assignee" field is populated.
|
|
name: PR Auto Assign
|
|
|
|
on:
|
|
# zizmor: ignore[dangerous-triggers] We explicitly want to run on pull_request_target.
|
|
pull_request_target:
|
|
types: [opened]
|
|
|
|
permissions: {}
|
|
|
|
jobs:
|
|
assign-author:
|
|
permissions:
|
|
pull-requests: write
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Harden Runner
|
|
uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
|
|
with:
|
|
egress-policy: audit
|
|
|
|
- name: Assign author
|
|
uses: toshimaru/auto-author-assign@3e19bfc990cb1cf0589dce95e9f75289bb1e22de # v3.0.3
|