Changeset 55715 for trunk/.github/workflows/welcome-new-contributors.yml

Timestamp:

05/03/2023 10:15:27 PM (18 months ago)

Author:

johnbillion

Message:

Build/Test Tools: Restrict the permissions granted to jobs on GitHub Actions

The permissions key in a job declares the GitHub permissions that are granted to the token that's used by the job. Restricting the permissions reduces the impact that a vulnerability in the CI system can have.

Props desrosj, johnbillion

See #57865

File:

• trunk/.github/workflows/welcome-new-contributors.yml (modified) (1 diff)

trunk/.github/workflows/welcome-new-contributors.yml

@@ -5 +5 @@
     types: [ opened ]
 
+# Disable permissions for all available scopes by default.
+# Any needed permissions should be configured at the job level.
+permissions: {}
+
 jobs:
   # Comments on a pull request when the author is a new contributor.
   post-welcome-message:
     runs-on: ubuntu-latest
+    permissions:
+      issues: write
     timeout-minutes: 5
     if: ${{ github.repository == 'WordPress/wordpress-develop' }}