Skip to content

Commit 0f30f4e

Browse files
laurentsimonlaurentsimon
authored
✨ Make permission check aware of GH Pages Action (#1902)
* update * update * update
1 parent 2fc6fbb commit 0f30f4e

File tree

4 files changed

+83
-29
lines changed

4 files changed

+83
-29
lines changed

‎checks/permissions.go‎

Lines changed: 16 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -566,7 +566,22 @@ func requiresPackagesPermissions(workflow *actionlint.Workflow, fp string, dl ch
566566

567567
// requiresContentsPermissions returns true if the workflow requires the `contents: write` permission.
568568
func requiresContentsPermissions(workflow *actionlint.Workflow, fp string, dl checker.DetailLogger) bool {
569-
return isReleasingWorkflow(workflow, fp, dl)
569+
return isReleasingWorkflow(workflow, fp, dl) || isGitHubPagesDeploymentWorkflow(workflow, fp, dl)
570+
}
571+
572+
// isGitHubPagesDeploymentWorkflow returns true if the workflow involves pushing static pages to GitHub pages.
573+
func isGitHubPagesDeploymentWorkflow(workflow *actionlint.Workflow, fp string, dl checker.DetailLogger) bool {
574+
jobMatchers := []fileparser.JobMatcher{
575+
{
576+
Steps: []*fileparser.JobMatcherStep{
577+
{
578+
Uses: "peaceiris/actions-gh-pages",
579+
},
580+
},
581+
LogText: "candidate GitHub page deployment workflow using peaceiris/actions-gh-pages",
582+
},
583+
}
584+
return fileparser.AnyJobsMatch(workflow, jobMatchers, fp, dl, "not a GitHub Pages deployment workflow")
570585
}
571586

572587
// isReleasingWorkflow returns true if the workflow involves creating a release on GitHub.

‎checks/permissions_test.go‎

Lines changed: 38 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -63,7 +63,7 @@ func TestGithubTokenPermissions(t *testing.T) {
6363
Score: checker.MaxResultScore,
6464
NumberOfWarn: 0,
6565
NumberOfInfo: 1,
66-
NumberOfDebug: 4,
66+
NumberOfDebug: 5,
6767
},
6868
},
6969
{
@@ -74,7 +74,7 @@ func TestGithubTokenPermissions(t *testing.T) {
7474
Score: checker.MaxResultScore - 1,
7575
NumberOfWarn: 1,
7676
NumberOfInfo: 1,
77-
NumberOfDebug: 4,
77+
NumberOfDebug: 5,
7878
},
7979
},
8080
{
@@ -85,7 +85,7 @@ func TestGithubTokenPermissions(t *testing.T) {
8585
Score: checker.MinResultScore,
8686
NumberOfWarn: 3,
8787
NumberOfInfo: 2,
88-
NumberOfDebug: 4,
88+
NumberOfDebug: 5,
8989
},
9090
},
9191
{
@@ -96,7 +96,7 @@ func TestGithubTokenPermissions(t *testing.T) {
9696
Score: checker.MaxResultScore,
9797
NumberOfWarn: 0,
9898
NumberOfInfo: 2,
99-
NumberOfDebug: 4,
99+
NumberOfDebug: 5,
100100
},
101101
},
102102
{
@@ -107,7 +107,7 @@ func TestGithubTokenPermissions(t *testing.T) {
107107
Score: checker.MinResultScore,
108108
NumberOfWarn: 1,
109109
NumberOfInfo: 1,
110-
NumberOfDebug: 4,
110+
NumberOfDebug: 5,
111111
},
112112
},
113113
{
@@ -118,7 +118,7 @@ func TestGithubTokenPermissions(t *testing.T) {
118118
Score: checker.MaxResultScore,
119119
NumberOfWarn: 0,
120120
NumberOfInfo: 1,
121-
NumberOfDebug: 5,
121+
NumberOfDebug: 6,
122122
},
123123
},
124124
{
@@ -129,7 +129,7 @@ func TestGithubTokenPermissions(t *testing.T) {
129129
Score: checker.MinResultScore,
130130
NumberOfWarn: 1,
131131
NumberOfInfo: 0,
132-
NumberOfDebug: 5,
132+
NumberOfDebug: 6,
133133
},
134134
},
135135
{
@@ -140,7 +140,7 @@ func TestGithubTokenPermissions(t *testing.T) {
140140
Score: checker.MaxResultScore,
141141
NumberOfWarn: 0,
142142
NumberOfInfo: 1,
143-
NumberOfDebug: 5,
143+
NumberOfDebug: 6,
144144
},
145145
},
146146
{
@@ -151,7 +151,7 @@ func TestGithubTokenPermissions(t *testing.T) {
151151
Score: checker.MinResultScore,
152152
NumberOfWarn: 1,
153153
NumberOfInfo: 0,
154-
NumberOfDebug: 5,
154+
NumberOfDebug: 6,
155155
},
156156
},
157157
{
@@ -162,7 +162,7 @@ func TestGithubTokenPermissions(t *testing.T) {
162162
Score: checker.MaxResultScore,
163163
NumberOfWarn: 0,
164164
NumberOfInfo: 1,
165-
NumberOfDebug: 6,
165+
NumberOfDebug: 7,
166166
},
167167
},
168168
{
@@ -173,7 +173,7 @@ func TestGithubTokenPermissions(t *testing.T) {
173173
Score: checker.MaxResultScore,
174174
NumberOfWarn: 0,
175175
NumberOfInfo: 10,
176-
NumberOfDebug: 5,
176+
NumberOfDebug: 6,
177177
},
178178
},
179179
{
@@ -184,7 +184,7 @@ func TestGithubTokenPermissions(t *testing.T) {
184184
Score: checker.MaxResultScore,
185185
NumberOfWarn: 0,
186186
NumberOfInfo: 10,
187-
NumberOfDebug: 5,
187+
NumberOfDebug: 6,
188188
},
189189
},
190190
{
@@ -195,7 +195,7 @@ func TestGithubTokenPermissions(t *testing.T) {
195195
Score: checker.MaxResultScore,
196196
NumberOfWarn: 0,
197197
NumberOfInfo: 1,
198-
NumberOfDebug: 5,
198+
NumberOfDebug: 6,
199199
},
200200
},
201201
{
@@ -206,7 +206,7 @@ func TestGithubTokenPermissions(t *testing.T) {
206206
Score: checker.MaxResultScore - 1,
207207
NumberOfWarn: 2,
208208
NumberOfInfo: 2,
209-
NumberOfDebug: 6,
209+
NumberOfDebug: 7,
210210
},
211211
},
212212
{
@@ -217,7 +217,7 @@ func TestGithubTokenPermissions(t *testing.T) {
217217
Score: checker.MaxResultScore - 2,
218218
NumberOfWarn: 2,
219219
NumberOfInfo: 3,
220-
NumberOfDebug: 5,
220+
NumberOfDebug: 6,
221221
},
222222
},
223223
{
@@ -228,7 +228,7 @@ func TestGithubTokenPermissions(t *testing.T) {
228228
Score: checker.MinResultScore,
229229
NumberOfWarn: 1,
230230
NumberOfInfo: 2,
231-
NumberOfDebug: 5,
231+
NumberOfDebug: 6,
232232
},
233233
},
234234
{
@@ -239,7 +239,7 @@ func TestGithubTokenPermissions(t *testing.T) {
239239
Score: checker.MinResultScore,
240240
NumberOfWarn: 1,
241241
NumberOfInfo: 2,
242-
NumberOfDebug: 5,
242+
NumberOfDebug: 6,
243243
},
244244
},
245245
{
@@ -250,7 +250,7 @@ func TestGithubTokenPermissions(t *testing.T) {
250250
Score: checker.MinResultScore,
251251
NumberOfWarn: 1,
252252
NumberOfInfo: 1,
253-
NumberOfDebug: 5,
253+
NumberOfDebug: 6,
254254
},
255255
},
256256
{
@@ -272,7 +272,7 @@ func TestGithubTokenPermissions(t *testing.T) {
272272
Score: checker.MinResultScore,
273273
NumberOfWarn: 1,
274274
NumberOfInfo: 2,
275-
NumberOfDebug: 3,
275+
NumberOfDebug: 4,
276276
},
277277
},
278278
{
@@ -294,7 +294,7 @@ func TestGithubTokenPermissions(t *testing.T) {
294294
Score: checker.MaxResultScore,
295295
NumberOfWarn: 0,
296296
NumberOfInfo: 2,
297-
NumberOfDebug: 4,
297+
NumberOfDebug: 5,
298298
},
299299
},
300300
{
@@ -305,7 +305,7 @@ func TestGithubTokenPermissions(t *testing.T) {
305305
Score: 9,
306306
NumberOfWarn: 1,
307307
NumberOfInfo: 3,
308-
NumberOfDebug: 4,
308+
NumberOfDebug: 5,
309309
},
310310
},
311311
{
@@ -316,7 +316,7 @@ func TestGithubTokenPermissions(t *testing.T) {
316316
Score: checker.MaxResultScore - 1,
317317
NumberOfWarn: 1,
318318
NumberOfInfo: 1,
319-
NumberOfDebug: 4,
319+
NumberOfDebug: 5,
320320
},
321321
},
322322
{
@@ -330,7 +330,7 @@ func TestGithubTokenPermissions(t *testing.T) {
330330
Score: checker.MaxResultScore - 1,
331331
NumberOfWarn: 1,
332332
NumberOfInfo: 2,
333-
NumberOfDebug: 9,
333+
NumberOfDebug: 11,
334334
},
335335
},
336336
{
@@ -344,7 +344,7 @@ func TestGithubTokenPermissions(t *testing.T) {
344344
Score: checker.MinResultScore,
345345
NumberOfWarn: 2,
346346
NumberOfInfo: 1,
347-
NumberOfDebug: 9,
347+
NumberOfDebug: 11,
348348
},
349349
},
350350
{
@@ -358,7 +358,20 @@ func TestGithubTokenPermissions(t *testing.T) {
358358
Score: checker.MinResultScore,
359359
NumberOfWarn: 1,
360360
NumberOfInfo: 1,
361-
NumberOfDebug: 10,
361+
NumberOfDebug: 12,
362+
},
363+
},
364+
{
365+
name: "read permission with GitHub pages write",
366+
filenames: []string{
367+
"./testdata/.github/workflows/github-workflow-permissions-gh-pages.yaml",
368+
},
369+
expected: scut.TestReturn{
370+
Error: nil,
371+
Score: checker.MaxResultScore,
372+
NumberOfWarn: 0,
373+
NumberOfInfo: 2,
374+
NumberOfDebug: 5,
362375
},
363376
},
364377
}

‎checks/testdata/.github/workflows/github-workflow-permissions-gh-pages.yaml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
# Copyright 2021 Security Scorecard Authors
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
name: write-and-read workflow
15+
on: [push]
16+
17+
permissions: read-all
18+
19+
jobs:
20+
Explore-GitHub-Actions:
21+
runs-on: ubuntu-latest
22+
permissions:
23+
contents: write
24+
steps:
25+
- run: echo "write-and-read workflow"
26+
- uses: peaceiris/actions-gh-pages@v3

‎e2e/permissions_test.go‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,7 @@ var _ = Describe("E2E TEST:"+checks.CheckTokenPermissions, func() {
5050
Score: checker.MinResultScore,
5151
NumberOfWarn: 1,
5252
NumberOfInfo: 2,
53-
NumberOfDebug: 5,
53+
NumberOfDebug: 6,
5454
}
5555
result := checks.TokenPermissions(&req)
5656
// New version.
@@ -75,7 +75,7 @@ var _ = Describe("E2E TEST:"+checks.CheckTokenPermissions, func() {
7575
Score: checker.MinResultScore,
7676
NumberOfWarn: 1,
7777
NumberOfInfo: 2,
78-
NumberOfDebug: 5,
78+
NumberOfDebug: 6,
7979
}
8080
result := checks.TokenPermissions(&req)
8181
// New version.
@@ -112,7 +112,7 @@ var _ = Describe("E2E TEST:"+checks.CheckTokenPermissions, func() {
112112
Score: checker.MinResultScore,
113113
NumberOfWarn: 1,
114114
NumberOfInfo: 2,
115-
NumberOfDebug: 5,
115+
NumberOfDebug: 6,
116116
}
117117
result := checks.TokenPermissions(&req)
118118
// New version.

0 commit comments

Comments
 (0)