OpenSSF scorecard "Token-permissions" score zero about undici HOT 4 CLOSED

#3013 closes this issue?

Not yet. I'm working on nodejs workflow. If everything ok I will close myself (else I will open another PR).

from undici.

#3013 closes this issue?

from undici.

My bad on that change. The GHA documentation is a bit bare on permissions, by not setting the global permissions does it essentially issue a full read-write token to the workflow?

Edit: Nvm found it: https://docs.github.com/en/actions/security-guides/automatic-token-authentication
These defaults are crazy permissive.

Also just to confirm: Are job-level permissions additive to workflow-level?

For example, in nightly at the workflow level we now have:

permissions:
  contents: read

then the report-failure job within that workflow:

  report-failure:
    permissions:
      issues: write

So there's no need to explicitly set contents: read in the report-failure?

from undici.

My bad on that change. The GHA documentation is a bit bare on permissions, by not setting the global permissions does it essentially issue a full read-write token to the workflow?

I think it depend on the Github permission setting (but by default yes it has read-write almost everywhere).

Also just to confirm: Are job-level permissions additive to workflow-level?

Yes. The basic idea is to set read at the root and then assign the right permission by jobs.

You can read more here about how OpenSSF scorecard build the score (there is also some tips and links).

from undici.