Merge pull request open-telemetry#70 from signalfx/GITHUB_TOKEN-permi…

…ssions Limit permissions of GITHUB_TOKEN
rockb1017 · May 4, 2021 · 0ade3b0 · 0ade3b0
2 parents d9717ab + 1972f02
commit 0ade3b0
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 0 deletions.
diff --git a/docs/repository.md b/docs/repository.md
@@ -40,6 +40,9 @@ approval is granted, GDI projects MUST NOT cut a GA release.
 
 - MUST use [GitHub secrets](https://docs.github.com/en/actions/reference/encrypted-secrets) to store sensitive data (auth tokens, passwords) and limit their usage to only required places
 - MUST NOT use [Personal Access Tokens](https://docs.github.com/en/github/authenticating-to-github/creating-a-personal-access-token) in GitHub Actions
+- MUST [limit permissions of `GITHUB_TOKEN`](https://docs.github.com/en/actions/reference/authentication-in-a-workflow#permissions-for-the-github_token) when used
+  - MUST only set the absolutely required `permissions` (least privilege)
+  - MUST set `permissions` for individual `jobs`
 
 ### GitHub Applications
 

diff --git a/docs/templates/.github/workflows/request-reviews.yml b/docs/templates/.github/workflows/request-reviews.yml
@@ -8,6 +8,8 @@ jobs:
   request:
     name: Request reviews on opened PRs
     runs-on: ubuntu-20.04
+    permissions:
+      issues: write
     steps:
       - name: Create PR review request
         env: