From 1c282a9306b6623ae258f365d1b759fdd4a4ade9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bj=C3=B6rn=20Svensson?= <bjorn.a.svensson@est.tech>
Date: Fri, 12 Apr 2024 17:24:22 +0200
Subject: [PATCH] Set permissions for Github Actions in CI (#312)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This sets the default permission for current CI workflows to only be
able to read from the repository (scope: "contents").
When a used Github Action require additional permissions (like CodeQL)
we grant that permission on job-level instead.

This means that a compromised action will not be able to modify the repo
or even steal secrets since all other permission-scopes are implicit set
to "none", i.e. not permitted. This is recommended by
[OpenSSF](https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions).

This PR includes a small fix for the possibility of missing server logs
artifacts, found while verifying the permission.
The `upload-artifact@v3` action will replace artifacts which already
exists. Since both CI-jobs `test-external-standalone` and
`test-external-nodebug` uses the same artifact name, when both jobs
fail, we only get logs from the last finished job. This can be avoided
by using unique artifact names.

This PR is part of #211

More about permissions and scope can be found here:

https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions

---------

Signed-off-by: Björn Svensson <bjorn.a.svensson@est.tech>
---
 .github/workflows/ci.yml                   | 3 +++
 .github/workflows/codeql-analysis.yml      | 5 +++++
 .github/workflows/coverity.yml             | 2 ++
 .github/workflows/daily.yml                | 2 ++
 .github/workflows/external.yml             | 7 +++++--
 .github/workflows/reply-schemas-linter.yml | 3 +++
 .github/workflows/spell-check.yml          | 3 +++
 7 files changed, 23 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7bd01183f2..137bd195c7 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -2,6 +2,9 @@ name: CI
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
 
   test-ubuntu-latest:
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 4c7484b99b..5055e6b8dc 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -6,11 +6,16 @@ on:
     # run weekly new vulnerability was added to the database
     - cron: '0 0 * * 0'
 
+permissions:
+  contents: read
+
 jobs:
   analyze:
     name: Analyze
     runs-on: ubuntu-latest
     if: github.event_name != 'schedule' || github.repository == 'valkey-io/valkey'
+    permissions:
+      security-events: write
 
     strategy:
       fail-fast: false
diff --git a/.github/workflows/coverity.yml b/.github/workflows/coverity.yml
index 791bb275b2..d63ba6ab53 100644
--- a/.github/workflows/coverity.yml
+++ b/.github/workflows/coverity.yml
@@ -6,6 +6,8 @@ on:
   - cron: '0 0 * * *'
   # Support manual execution
   workflow_dispatch:
+permissions:
+  contents: read
 jobs:
   coverity:
     if: github.repository == 'valkey-io/valkey'
diff --git a/.github/workflows/daily.yml b/.github/workflows/daily.yml
index a4ecf31ecf..178d9b7ceb 100644
--- a/.github/workflows/daily.yml
+++ b/.github/workflows/daily.yml
@@ -28,6 +28,8 @@ on:
         description: 'git branch or sha to use'
         default: 'unstable'
 
+permissions:
+  contents: read
 
 jobs:
 
diff --git a/.github/workflows/external.yml b/.github/workflows/external.yml
index bd6b438394..8111c5e6cd 100644
--- a/.github/workflows/external.yml
+++ b/.github/workflows/external.yml
@@ -6,6 +6,9 @@ on:
   schedule:
     - cron: '0 0 * * *'
 
+permissions:
+  contents: read
+
 jobs:
   test-external-standalone:
     runs-on: ubuntu-latest
@@ -29,7 +32,7 @@ jobs:
       if: ${{ failure() }}
       uses: actions/upload-artifact@v3
       with:
-        name: test-external-server-log
+        name: test-external-standalone-log
         path: external-server.log
 
   test-external-cluster:
@@ -81,5 +84,5 @@ jobs:
         if: ${{ failure() }}
         uses: actions/upload-artifact@v3
         with:
-          name: test-external-server-log
+          name: test-external-nodebug-log
           path: external-server.log
diff --git a/.github/workflows/reply-schemas-linter.yml b/.github/workflows/reply-schemas-linter.yml
index a57a97ab3d..eb14a27204 100644
--- a/.github/workflows/reply-schemas-linter.yml
+++ b/.github/workflows/reply-schemas-linter.yml
@@ -8,6 +8,9 @@ on:
     paths:
       - 'src/commands/*.json'
 
+permissions:
+  contents: read
+
 jobs:
   reply-schemas-linter:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/spell-check.yml b/.github/workflows/spell-check.yml
index e146b79c94..b4bc62e7b0 100644
--- a/.github/workflows/spell-check.yml
+++ b/.github/workflows/spell-check.yml
@@ -9,6 +9,9 @@ on:
   push:
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Spellcheck