[Octave-bug-tracker] [bug #62461] [GitHub] [Workflows] GITHUB_TOKEN with too much permissions

[Markus Mützel]

Follow-up Comment #1, bug #62461 (project octave):

Thanks for your report.

I guess you are referring to the read-only mirror of Octave on GitHub here:
https://github.com/gnu-octave/octave

I'm trying to come up with a scenario where the permissions of GITHUB_TOKEN
could actually become an issue. Could you please elaborate?

Anyway, restricting the permissions per workflow file would probably not hurt.
But if a malicious party gained access to triggering a (modified) workflow
run, they could probably also change the permissions in those files to
anything they'd like anyway...


    _______________________________________________________

Reply to this item at:

  <https://savannah.gnu.org/bugs/?62461>

_______________________________________________
  Message sent via Savannah
  https://savannah.gnu.org/