[PR #3155] [MERGED] Set least privileged token permission for GitHub Actions #4691

New issue

Closed

opened 2026-05-05 14:46:53 -06:00 by gitea-mirror · 0 comments

gitea-mirror commented

2026-05-05 14:46:53 -06:00

Owner

📋 Pull Request Information

Original PR: https://github.com/fatedier/frp/pull/3155
Author: @ashishkurmi
Created: 10/31/2022
Status: ✅ Merged
Merged: 10/31/2022
Merged by: @fatedier

Base: dev ← Head: dev

📝 Commits (1)

85397ed Set least privileged token permission for GitHub Actions

📊 Changes

3 files changed (+12 additions, -0 deletions)

View changed files

📝 .github/workflows/build-and-push-image.yml (+3 -0)
📝 .github/workflows/goreleaser.yml (+3 -0)
📝 .github/workflows/stale.yml (+6 -0)

📄 Description

Other than golangci-lint.yml, all other GitHub Actions workflow files have elevated token permissions as demonstrated by the following workflow execution logs.
https://github.com/fatedier/frp/actions/runs/3334432128/jobs/5517384845#step:1:19

This PR mitigates this issue. In addition to this PR, you should consider setting the following permission so that new workflow files will default to read-only permissions
https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository

Signed-off-by: Ashish Kurmi akurmi@stepsecurity.io

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/fatedier/frp/pull/3155 **Author:** [@ashishkurmi](https://github.com/ashishkurmi) **Created:** 10/31/2022 **Status:** ✅ Merged **Merged:** 10/31/2022 **Merged by:** [@fatedier](https://github.com/fatedier) **Base:** `dev` ← **Head:** `dev` --- ### 📝 Commits (1) - [`85397ed`](https://github.com/fatedier/frp/commit/85397edcc4398fb94572140823d68f9f2645e7e6) Set least privileged token permission for GitHub Actions ### 📊 Changes **3 files changed** (+12 additions, -0 deletions) <details> <summary>View changed files</summary> 📝 `.github/workflows/build-and-push-image.yml` (+3 -0) 📝 `.github/workflows/goreleaser.yml` (+3 -0) 📝 `.github/workflows/stale.yml` (+6 -0) </details> ### 📄 Description Other than `golangci-lint.yml`, all other GitHub Actions workflow files have elevated token permissions as demonstrated by the following workflow execution logs. https://github.com/fatedier/frp/actions/runs/3334432128/jobs/5517384845#step:1:19 This PR mitigates this issue. In addition to this PR, you should consider setting the following permission so that new workflow files will default to read-only permissions https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository Signed-off-by: Ashish Kurmi <akurmi@stepsecurity.io> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>