[
https://issues.apache.org/jira/browse/HADOOP-19868?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18075590#comment-18075590
]
ASF GitHub Bot commented on HADOOP-19868:
-----------------------------------------
pan3793 commented on code in PR #8450:
URL: https://github.com/apache/hadoop/pull/8450#discussion_r3127962695
##########
.github/workflows/tmpl_build_and_test.yml:
##########
@@ -86,6 +90,19 @@ jobs:
name: Build Image ${{ inputs.os }}-${{ inputs.branch }}
runs-on: ubuntu-24.04
needs: [ precondition ]
+ # Security: this does not leak write access for our image repository to
+ # forked repos.
+ #
+ # We have `packages: write` permissions for our GITHUB_TOKEN below.
However:
+ #
+ # - For `pull_request`, GitHub downgrades GITHUB_TOKEN permissions to
+ # read-only.
+ # - For `push` triggers on a fork, the GITHUB_TOKEN retains write
+ # permissions, but the `push` is happening in the context of the fork,
not
+ # the upstream repo.
+ # - For `pull_request_target` (not used here), image repo permissions are
+ # scoped to the repository they run on. This prevents forks from writing
+ # to our Apache Hadoop image repo.
Review Comment:
I will find time to verify that and report it back
> ci: add security comments to github actions
> -------------------------------------------
>
> Key: HADOOP-19868
> URL: https://issues.apache.org/jira/browse/HADOOP-19868
> Project: Hadoop Common
> Issue Type: Sub-task
> Components: test
> Reporter: Aaron Fabbri
> Assignee: Aaron Fabbri
> Priority: Minor
> Labels: pull-request-available
>
> Following up on HADOOP-19858, I have a patch for some `# Security:` comments
> to add to our github actions to explain why each workflow is safe.
> I'm also following up on INFRA-27839, just to double check they haven't
> enabled any risky defaults. I'll add comments with any details I find.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
