scorecard icon indicating copy to clipboard operation
scorecard copied to clipboard

Published 20 hours ago • verified publisher icon ossf

`checks: write` gha permission is needed for pushing SARIF annotations on Pull Requests

Open nitrocode opened this issue 7 months ago • 2 comments
trafficstars

https://securityscorecards.dev/viewer/?uri=github.com/runatlantis/atlantis

Warn: topLevel 'checks' permission set to 'write': .github/workflows/lint.yml:24

In our case, to push SARIF annotations in a PR from a linter like golangci-lint, it requires checks: write and of course that gets flagged by OpenSSF.

Request:

  • It would be good to call out examples where high privileges in github actions are needed
  • How to least-privilege the action with this permission to improve the score

nitrocode avatar Apr 03 '25 23:04 nitrocode