bitwarden/self-host
1
0
Fork 0
mirror of https://github.com/bitwarden/self-host.git synced 2025-12-11 04:39:26 -06:00
Code Issues Packages Projects Releases 89 Wiki Activity

[update-versions.yml] Implement least privilege permissions (#429)

Browse Source 
- Add empty permission set at workflow level
- Remove contents:write from job, add to GitHub App token
This commit is contained in:
gitclonebrian 2025-12-02 10:34:13 -05:00 committed by GitHub
parent 7cd468ea62
commit 9e57cafee3
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
.github/workflows/update-versions.yml vendored
View File

@ -3,6 +3,8 @@ name: Update Versions
on: on:
workflow_dispatch: workflow_dispatch:
permissions: {}
jobs: jobs:
setup: setup:
name: Setup name: Setup
@ -101,7 +103,6 @@ jobs:
runs-on: ubuntu-24.04 runs-on: ubuntu-24.04
needs: setup needs: setup
permissions: permissions:
contents: write
id-token: write id-token: write
steps: steps:
- name: Log in to Azure - name: Log in to Azure
@ -127,6 +128,8 @@ jobs:
with: with:
app-id: ${{ steps.get-kv-secrets.outputs.BW-GHAPP-ID }} app-id: ${{ steps.get-kv-secrets.outputs.BW-GHAPP-ID }}
private-key: ${{ steps.get-kv-secrets.outputs.BW-GHAPP-KEY }} private-key: ${{ steps.get-kv-secrets.outputs.BW-GHAPP-KEY }}
permission-contents: write
- name: Checkout Branch - name: Checkout Branch
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0