nearform-actions/optic-release-automation-action

Use more restrictive permissions

Closed this issue · 8 comments

gregoryduckworth commented

Rather than use the open GITHUB_TOKEN with the ability to read/write to everything we should advise more restrictive permissions. We should update the documentation to match.

I believe the permissions should be:

permissions:
  contents: write
  issues: write
  pull-requests: write
Eomm commented

+1 I hit this issue today

Permission to Eomm/notion-board.git denied to github-actions[bot].

The token to read by default when creating a new repo (at least I did not set it manually)

Adding the permissions solved the issue 👍🏼

simoneb commented

@Eomm @gregoryduckworth as we're in the process of moving all the actions to a different org, I would wait until that's done to do this change, which is basically only a change in the docs about how to configure the workflows in which the actions are used. We never noticed this because we have a more permissive setting at the org level, but we realized that in newly created orgs the default is different, so it needs to be documented.

simoneb commented

I'm not sure where we stand on this but I believe this wasn't actually done. I'm also not sure about the permissions, the current docs seem to document something different, but I believe that writing to issues may be necessary when the notify-issues setting is enabled (which it is by default).

simoneb commented

This list only includes repos in this org, which are basically ALL repos. We need to apply this change to ALL repos using this action in the main nearform org too.

gregoryduckworth commented

This list only includes repos in this org, which are basically ALL repos. We need to apply this change to ALL repos using this action in the main nearform org too.

Yeah, @grantmorrison reached out as he was having issues searching in the nearform-actions organisation which was returning zero results on the search, so I've provided them here.

grantmorrison commented

What's the ideal way to proceed?

I could manually update all the repos but this sounds problematic for various reasons:

  1. There are 80 or so results in the NearForm org and I don't think that's a manageable number of PRs
  2. I don't trust I'm seeing a full list of results as per Gregs explanation

@simoneb, you mentioned some form of automation which might help but I'm unsure what that is or how I might take advantage of it. Are you able to provide some details in the ticket/comments?

github-actions commented

🎉 This issue has been resolved in version 4.4.6 🎉

The release is available on:

Your optic bot 📦🚀