Reduce Set and Scope of Permissions for GitHub Token in GH Workflows
FelixS90 opened this issue · 0 comments
FelixS90 commented
Is your feature request related to a problem? Please describe.
Currently, the permissions granted to GitHub Token are set to write-all on top-level. From a principle-of-least-privilege point of view this should be reduced to only the permissions needed. This was brought up by this run.
Describe the solution you'd like
Use permissions: read-all in top-level and extend on job-level if needed.
Describe alternatives you've considered
Disable the linter to report this issue - no functional change.
bridgecrewio/checkov#4127
Additional context
