At https://github.com/step-security/secure-workflows we are building a knowledge-base (KB) of GITHUB_TOKEN permissions needed by different GitHub Actions. When developers try to set minimum token permissions for their workflows, they can use this knowledge-base instead of trying to research permissions needed by each GitHub Action they use.

Below you can see the KB of your GITHUB Action.

name: 'Verify Files Modify'
github-token:
  action-input:
    input: token
  permissions:
    pull-requests: write
    pull-requests-reason: to update status of PRs #Checkout: https://github.com/actions-cool/verify-files-modify/blob/61404155b337d24034af65ea3527be289c4d9994/src/main.js#L154
    issues: read
    issues-reason: to query comment in issues #Checkout:https://github.com/actions-cool/verify-files-modify/blob/61404155b337d24034af65ea3527be289c4d9994/src/main.js#L108
    contents: read
    contents-reason: to query creator permission level #Checkout: https://github.com/actions-cool/verify-files-modify/blob/61404155b337d24034af65ea3527be289c4d9994/src/main.js#L59

# Fix #554

If you think this information is not accurate, or if in the future your GitHub Action starts using a different set of permissions, please create an issue at https://github.com/step-security/secure-workflows/issues to let us know.

This issue is automatically created by our analysis bot, feel free to close after reading :)

References:

GitHub asks users to define workflow permissions, see https://github.blog/changelog/2021-04-20-github-actions-control-permissions-for-github_token/ and https://docs.github.com/en/actions/security-guides/automatic-token-authentication#modifying-the-permissions-for-the-github_token for securing GitHub workflows against supply-chain attacks.

Setting minimum token permissions is also checked for by Open Source Security Foundation (OpenSSF) Scorecards. Scorecards recommend using https://github.com/step-security/secure-workflows so developers can fix this issue in an easier manner.

Hi there, I am thinking of using this action to prevent unauthorized users from modifying the workflows files in a github repo.

As you may know, github's write authorization on a repo for a user cannot be set on a fine grained level; for example only to a specific paths or folders. So a contributor with write access can modify any files on that repo, but the repo maintainer may want to protect the workflows files and only allows a subset of people (from a list of allowed github user ids or code owners) to modify them.

So I am wondering if we can add a feature for the action to skip verify if the user opening the PR is on the list of allowed github user ids or one of workflows files' code owners. I am thinking this is very similar to skip-verify-authority option, except it decides on user_ids rather than permissions.

Thanks.