Hi I'm from Google and the OpenSSF and I work on helping open source projects to increase their supply chain security.
The problem
A quick explanation of the problem: Github workflows by default grant all write permissions to GITHUB_TOKEN, which could be exploit by an attacker if the workflow got compromised.
It is a default behavior of github workflows to grant write permissions to all permissions, thus it is both a recommendation from OpenSSF Scorecard and the Github to always use credentials that are minimally scoped.
Description
I've notice that all the other workflows except cifuzz are using minimally scoped permissions, which is really great to see! I would like to suggest a PR just to also set the permissions to cifuzz. Let me know if the PR is welcome.
Hi I'm from Google and the OpenSSF and I work on helping open source projects to increase their supply chain security.
The problem
A quick explanation of the problem: Github workflows by default grant all write permissions to GITHUB_TOKEN, which could be exploit by an attacker if the workflow got compromised.
It is a default behavior of github workflows to grant write permissions to all permissions, thus it is both a recommendation from OpenSSF Scorecard and the Github to always use credentials that are minimally scoped.
Description
I've notice that all the other workflows except cifuzz are using minimally scoped permissions, which is really great to see! I would like to suggest a PR just to also set the permissions to cifuzz. Let me know if the PR is welcome.