Skip to content

Autobuild: Minimize JSON-RPC workflow permissions#2962

Merged
ann0see merged 2 commits intojamulussoftware:masterfrom
ann0see:autobuild/hardenRPC
Dec 26, 2022
Merged

Autobuild: Minimize JSON-RPC workflow permissions#2962
ann0see merged 2 commits intojamulussoftware:masterfrom
ann0see:autobuild/hardenRPC

Conversation

@ann0see
Copy link
Copy Markdown
Member

@ann0see ann0see commented Nov 19, 2022

Short description of changes
Removes any permissions from JSON-RPC check. We might even drop the secret in the env fully.

It fails as expected if there is a change to the function documentation:
https://github.com/ann0see/jamulus/actions/runs/3505130530

Other change doesn't make the check fail: https://github.com/ann0see/jamulus/actions/runs/3505127551

CHANGELOG: SKIP
Context: Fixes an issue?
No. But related to #1737

Does this change need documentation? What needs to be documented and how?

No

Status of this Pull Request
Review by @hoffie

What is missing until this pull request can be merged?
Theoretical review. I might not have thought about all possible cases where this check should be run.

Checklist

  • I've verified that this Pull Request follows the general code principles
  • I tested my code and it does what I want
  • My code follows the style guide
  • I waited some time after this Pull Request was opened and all GitHub checks completed without errors.
  • I've filled all the content above

@ann0see ann0see requested a review from hoffie November 19, 2022 21:06
Copy link
Copy Markdown
Member

@hoffie hoffie left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good to me.

We might even drop the secret in the env fully.

Worth a try. ;)

@ann0see
Copy link
Copy Markdown
Member Author

ann0see commented Dec 25, 2022

Ok. Removing the token works:

Successful run without changes: https://github.com/ann0see/jamulus/actions/runs/3777431973/jobs/6421260779
Failed run with changes: https://github.com/ann0see/jamulus/actions/runs/3777433469

@ann0see ann0see added this to the Release 3.10.0 milestone Dec 25, 2022
@ann0see ann0see requested a review from pljones December 25, 2022 20:59
@ann0see
Copy link
Copy Markdown
Member Author

ann0see commented Dec 25, 2022

I think after this is merged, we can remove even more permissions in GH settings.

Copy link
Copy Markdown
Collaborator

@pljones pljones left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Build is clean -> good.

@ann0see ann0see merged commit 78937f6 into jamulussoftware:master Dec 26, 2022
@ann0see ann0see deleted the autobuild/hardenRPC branch December 26, 2022 09:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: Done

Development

Successfully merging this pull request may close these issues.

3 participants