[PERF-324] Improve Workflow Permissions (#105)

* Improve Workflow Permissions * set checks: write * removed redundant read permissions
Ed-Fi-Exchange-OSS · Jun 11, 2024 · 9fcf489 · 9fcf489
1 parent 38f7d37
commit 9fcf489
Show file tree

Hide file tree

Showing 7 changed files with 20 additions and 4 deletions.
diff --git a/.github/workflows/Package_pre_release.yml b/.github/workflows/Package_pre_release.yml
@@ -7,6 +7,8 @@ name: Package Pre-Release-Code
 on:
   workflow_dispatch:
 
+permissions: read-all
+
 env:
   PACKAGE_NAME: Suite_3_Performance_Test_Suite_Package_Pre-Release
 

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
@@ -15,15 +15,15 @@ on:
     branches:
       - main
 
+permissions: read-all
+
 jobs:
   analyze:
     name: Analyze Code
     runs-on: ubuntu-latest
     env:
         SRC_DIR: src/edfi-paging-test
     permissions:
-      actions: read
-      contents: read
       security-events: write
 
     strategy:

diff --git a/.github/workflows/dependencies.yml b/.github/workflows/dependencies.yml
@@ -12,6 +12,8 @@ on:
     paths:
       - 'src/**'
 
+permissions: read-all
+
 jobs:
   scan-actions:
     name: Scan Actions
@@ -21,8 +23,6 @@ jobs:
     name: Analyze Code Dependencies
     runs-on: ubuntu-latest
     permissions:
-      actions: read
-      contents: read
       security-events: write
 
     strategy:

diff --git a/.github/workflows/edfi_paging_test.yml b/.github/workflows/edfi_paging_test.yml
@@ -17,6 +17,8 @@ on:
       - main
   workflow_dispatch:
 
+permissions: read-all
+
 jobs:
   test-edfi-paging-test:
     name: Run unit, style, and type checks
@@ -25,6 +27,9 @@ jobs:
         PACKAGE_NAME: edfi-paging-test
         SRC_DIR: src/edfi-paging-test
         LOCK_FILE: src/edfi-paging-test/poetry.lock
+    permissions:
+        checks: write
+
     steps:
       - name: Checkout code
         uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b  # v3.0.2

diff --git a/.github/workflows/edfi_performance_test.yml b/.github/workflows/edfi_performance_test.yml
@@ -17,6 +17,8 @@ on:
       - main
   workflow_dispatch:
 
+permissions: read-all
+
 jobs:
   test-edfi-performance-test:
     name: Run unit, style, and type checks
@@ -25,6 +27,9 @@ jobs:
         PACKAGE_NAME: edfi-performance-test
         SRC_DIR: src/edfi-performance-test
         LOCK_FILE: src/edfi-performance-test/poetry.lock
+    permissions:
+        checks: write
+
     steps:
       - name: Checkout code
         uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b  # v3.0.2

diff --git a/.github/workflows/start-VM.yml b/.github/workflows/start-VM.yml
@@ -7,6 +7,8 @@ name: Start Azure VM
 on:
   workflow_dispatch:
 
+permissions: read-all
+
 env:
     AzureADServicePrincipalPassword: ${{ secrets.AZURE_SERVICE_PRINCIPAL_PASSWORD }}
     AzureADApplicationId: ${{ vars.AZURE_SERVICE_APPLICATION_ID }}

diff --git a/.github/workflows/stop-VM.yml b/.github/workflows/stop-VM.yml
@@ -7,6 +7,8 @@ name: Stop Azure VM
 on:
   workflow_dispatch:
 
+permissions: read-all
+
 env:
     AzureADServicePrincipalPassword: ${{ secrets.AZURE_SERVICE_PRINCIPAL_PASSWORD }}
     AzureADApplicationId: ${{ vars.AZURE_SERVICE_APPLICATION_ID }}
-Original file line number
+Diff line change
@@ Expand Up / @@ -7,6 +7,8 @@ name: Package Pre-Release-Code @@
     on:
       workflow_dispatch:
+    permissions: read-all
     env:
       PACKAGE_NAME: Suite_3_Performance_Test_Suite_Package_Pre-Release
@@ Expand Down @@