https://github.com/GitHubSecurityLab/actions-permissions

GitHub token permissions Monitor and Advisor actions
https://github.com/GitHubSecurityLab/actions-permissions

actions permissions security

Last synced: 6 days ago
JSON representation

GitHub token permissions Monitor and Advisor actions

• Host: GitHub
• URL: https://github.com/GitHubSecurityLab/actions-permissions
• Owner: GitHubSecurityLab
• License: mit
• Created: 2023-03-29T15:37:58.000Z (about 2 years ago)
• Default Branch: main
• Last Pushed: 2024-07-09T07:42:48.000Z (9 months ago)
• Last Synced: 2024-08-02T16:44:37.516Z (9 months ago)
• Topics: actions, permissions, security
• Language: Python
• Homepage:
• Size: 12 MB
• Stars: 246
• Watchers: 4
• Forks: 19
• Open Issues: 5
• Metadata Files:
  • Readme: README.md
  • License: LICENSE
  • Security: SECURITY.md

Awesome Lists containing this project

• my-awesome-starred - GitHubSecurityLab/actions-permissions - GitHub token permissions Monitor and Advisor actions (Python)

README

        
# GitHub token permissions Monitor and Advisor actions (PUBLIC BETA)

![Logo](res/logo.png "Logo")

https://user-images.githubusercontent.com/26652396/233825493-caf6a8ea-12f0-4d2f-b2ca-466784bea28d.mp4

Applying the least privilege permissions to a GitHub Actions workflow is a best security practice, but can be challenging as it may break existing workflows.

The Monitor action, when added to a workflow, tracks the usage of the temporary GitHub repository token and gives recommendations on the minimum permissions required to run the workflow based on the actual detected workflow activity. Every workflow run generates a summary report with the recommendations. Since some steps or jobs may be skipped based on various conditions, the Advisor action can aggregate and summarize the recommendations from multiple workflow runs.

![Workflow run summary with permissions recommendations for every job](res/summary.png "Minimal required permissions")

The typical scenario is to include the Monitor action in every job of the workflow that doesn't specify permissions explicitly, collect the recommendations from several workflow runs, apply the recommended minimal permissions, and then remove the Monitor action.

## Usage

[See the Monitor action](monitor)

[See the Advisor action](advisor)