OpenSSF scorecard "Token-permissions" score zero

[fraxken]

Hello there 👋,

Today in the Node.js security meeting we discussed that the undici project score had dropped due to a change in the workflows. This seems to be related to the following commit.

Full report here

1. nightly.yml and test.yml seems to lack global permissions

permissions:
  contents: read

2. In nodejs.yml we have warnings to reviews the following permission.

undici/.github/workflows/nodejs.yml

Lines 102 to 105 in d3d24e2

	permissions:
	contents: write
	pull-requests: write
	actions: write

Github Action Merge Dependabot require pull-requests and contents (not sure if actions is required). These warnings are perhaps to be ignored.

@nodejs/security-wg

[metcoder95]

#3013 closes this issue?

[fraxken]

#3013 closes this issue?

Not yet. I'm working on nodejs workflow. If everything ok I will close myself (else I will open another PR).

[mweberxyz]

My bad on that change. The GHA documentation is a bit bare on permissions, by not setting the global permissions does it essentially issue a full read-write token to the workflow?

Edit: Nvm found it: https://docs.github.com/en/actions/security-guides/automatic-token-authentication
These defaults are crazy permissive.

Also just to confirm: Are job-level permissions additive to workflow-level?

For example, in nightly at the workflow level we now have:

permissions:
  contents: read

then the report-failure job within that workflow:

  report-failure:
    permissions:
      issues: write

So there's no need to explicitly set contents: read in the report-failure?

[fraxken]

My bad on that change. The GHA documentation is a bit bare on permissions, by not setting the global permissions does it essentially issue a full read-write token to the workflow?

I think it depend on the Github permission setting (but by default yes it has read-write almost everywhere).

Also just to confirm: Are job-level permissions additive to workflow-level?

Yes. The basic idea is to set read at the root and then assign the right permission by jobs.

You can read more here about how OpenSSF scorecard build the score (there is also some tips and links).