Skip to content

Track explicit GITHUB_TOKEN permissions for a read-only default #187

Description

@theletterf

Summary

InfoSec plans to change the default GitHub Actions GITHUB_TOKEN from read/write to read-only. We should track the docs repos audit work needed to make sure workflows that write through the default token declare those permissions explicitly.

Preferred pattern:

permissions: {}

jobs:
  some-job:
    permissions:
      contents: write
      pull-requests: write

Or, when only read access is needed across the workflow:

permissions:
  contents: read

The goal is to avoid granting broad workflow-level write permissions that could leak to future jobs.

Audit status so far

  • elastic/docs-actions: reviewed, no fixes needed.
  • elastic/elastic-agent: reviewed local workflows, no fixes needed for the default token.
  • elastic/opentelemetry: reviewed local workflows, no fixes needed for the default token.
  • elastic/integration-docs: reviewed local workflows, no fixes needed for the default token.
  • elastic/integrations: reviewed local workflows, no fixes needed for the default token.
  • elastic/docs-content: fixes opened.
  • elastic/docs: fixes opened.
  • elastic/docs.elastic.co: fixes opened.

Current fixes in flight

Next steps

  1. Merge the open fixes.
  2. Continue auditing any remaining docs repos that use GitHub Actions.
  3. Standardize on job-level write permissions when follow-up workflow edits are needed.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

Type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions