fix: scope publish smoke-test token and correct CodeQL build comment#140
Merged
Conversation
publish.yml set contents: write at the workflow level so the publish
job's gh release create/upload calls work, but the smoke-test job
inherited that write scope too even though it only checks out the repo
and curls a public Maven Central URL. Add a job-level contents: read
override so a compromised action in that job can't use a write token
it never needed.
Also update codeql.yml's build-scope comments: they said the manual
compileKotlinJvm step only touches :kuri and :kuri-bind, but the task
is invoked unqualified, so Gradle also runs it in kuri-serde-kotlinx,
which has its own jvm {} target and production Kotlin source. List all
three modules so the comment matches what's actually compiled and
scanned.
Closes #90, #101
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
publish.ymlsetcontents: writeat the workflow level for thepublishjob'sgh release create/gh release uploadcalls, but thesmoke-testjob inherited that same write scope even though it only checks out the repo and curls a public Maven Central URL with noGH_TOKENset. Add a job-levelpermissions: contents: readoverride onsmoke-testso its token carries no more privilege than the job actually uses.codeql.yml's comments said the manualcompileKotlinJvmbuild step "runs in:kuriand:kuri-bind," but the task is invoked unqualified, so Gradle also runs it inkuri-serde-kotlinx, which declares its ownjvm {}target with real production Kotlin source. Updated both comments (top-of-file and next to the compile step) to list all three modules.Test plan
YAML.load_file(Ruby's stdlib YAML) to confirm they're still well-formedpermissionsoverride is scoped to thesmoke-testjob only and doesn't touchpublish's workflow-levelcontents: writeCloses #90
Closes #101