Repository navigation
Declare the token scopes, drop the stored checkout credentials, lock the actions and add the Plumber check - #1066
Closed
Totara-thib wants to merge 5 commits into
Closed
Totara-thib wants to merge 5 commits into
Totara-thib wants to merge 5 commits into
Conversation
Seven workflows had no permissions block, so their jobs ran with the repository's default token scopes. They read the tree, build and test, or post to Slack with the bot token, so the workflow level says contents: read. Two jobs write with the job token and say so: the integration run on a fork updates its own check run, the labeler creates and updates the repository labels. CodeQL, the release notes cleanup and dependency review keep the blocks they already declare.
actions/checkout leaves the job token in .git/config by default, where every later step and tool in the job can read it. The eleven checkouts opt out: the test report goes to object storage with its own keys and nothing pushes with git.
The security scan tracked the master branch of its action, which changes with every push there. It now references the v2.30.0 release, so the lockfile below holds one commit for it.
GitHub's workflow dependency lockfile holds the commit each action reference resolves to, transitive actions included, and the runner uses those commits even if a tag moves later. .github/workflows/actions.lock comes from gh actions-lock (v0.4.0), which also narrowed every reference to the exact release it locked, so Dependabot keeps bumping versions and its security alerts keep matching. Re-run the same command after adding or bumping an action.
A small workflow runs the Plumber CLI on pushes to main and on pull requests. It checks the GitHub workflows for the classes of findings the previous commits fixed (missing permissions, tokens left in checkouts, floating action refs) and fails under 85 points, so one small finding never blocks a pull request. Its two actions are recorded in actions.lock like the others. The overlay keeps the built-in defaults and trusts the four actions this repository uses on top of them. The README gets the score badge in the badge row.
Totara-thib
requested review from
jriddle-linode and
psnoch-akamai
and removed request for
a team
October 29, 2026 15:20
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
The gosec pin runs an older scanner, new workflows can bypass lockfile coverage, and the SARIF condition mishandles fork PRs and Dependabot pushes.
3 open issues
What changed in this PR
This PR hardens the Go client's GitHub Actions workflows, including jobs that use live Linode credentials, and adds automated workflow-security checks.
Changes:
- Declares token permissions and disables credential persistence in checkout steps.
- Replaces broad action references with release tags and adds a workflow dependency lockfile.
- Adds Plumber checks with an 85-point threshold, repository configuration, and a README score badge.
| File | Description |
|---|---|
| README.md | Adds the Plumber score badge. |
| .plumber.yaml | Configures trusted actions alongside Plumber defaults. |
| .github/workflows/security_pr.yml | Restricts permissions, disables stored credentials, and updates scanner references. |
| .github/workflows/release-notify-slack.yml | Declares read-only permissions and specifies the Slack action release. |
| .github/workflows/release-cross-repo-test.yml | Hardens checkouts and specifies action releases. |
| .github/workflows/plumber.yml | Adds security scoring, report uploads, and badge publication. |
| .github/workflows/nightly_smoke_tests.yml | Restricts permissions and hardens the live-test checkout. |
| .github/workflows/labeler.yml | Grants label-management permissions and updates action references. |
| .github/workflows/integration_tests_pr.yml | Scopes permissions for integration jobs and hardens checkouts. |
| .github/workflows/codeql.yml | Disables stored credentials and specifies CodeQL releases. |
| .github/workflows/clean-release-notes.yml | Specifies the GitHub Script action release. |
| .github/workflows/ci.yml | Declares read-only permissions, hardens checkouts, and updates action references. |
| .github/workflows/actions.lock | Records action commits and nested dependencies for listed workflows. |
Review effort: Balanced
| with: | ||
| persist-credentials: false | ||
|
|
||
| - uses: getplumber/plumber@v0.7.16 |
Comment on lines
+31
to
+34
| # Code scanning upload needs security-events write, which PRs | ||
| # from forks do not get. The report stays available as a | ||
| # workflow artifact there. | ||
| upload-sarif: ${{ github.event.pull_request.head.repo.fork != true }} |
|
|
||
| - name: Run Gosec Security Scanner on root directory | ||
| uses: securego/gosec@master | ||
| uses: securego/gosec@v2.30.0 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
📝 Description
What does this PR do and why is this change necessary?
Following Aurélien's exchange with Scott, here is the pull request offered.
contents: read, pluspull-requests: readandchecks: writeon the fork integration job (its check run),issues: writeon the labeler.@master.actions.lockis GitHub's own workflow dependency lockfile, generated withgh actions-lock: the commit behind each action (floating refs), enforced by the runner, whileuses:keeps the release tags Dependabot bumps.Why: the integration and nightly jobs hold a real Linode account's token. A wider job token or a moved action tag there reaches it, the tj-actions incident (CVE-2025-30066) went through that door.
If the allowed-actions setting uses tag patterns, switch them to
owner/action@*.✔️ How to Test
The checks run on this pull request, Plumber's included, and
gh actions-lock --verifyconfirms the lockfile.Found and fixed by Plumber's analysis, reviewed and submitted by me.