How to set GitHub Actions's `permissions`?
Tags: github, githubactions, ci, security
Published: 2021-07-21 00:45:45

---
title: How to set GitHub Actions's `permissions`?
published: true
description: What it GitHub Actions's permissions and how to imprive it.
tags: GitHub, GitHubActions, CI, security
//cover_image: https://direct_url_to_image.jpg
---

GitHub introduce `permissions` fields on GitHub Actions for security reasons.

- [GitHub Actions: Control permissions for GITHUB_TOKEN | GitHub Changelog](https://github.blog/changelog/2021-04-20-github-actions-control-permissions-for-github_token/)
- [Workflow syntax for GitHub Actions - GitHub Docs](https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#permissions)

The `permissions` field will help you to prevent software supply chain attack.

For example, codecov's bash script is hacked recently.

- [Bash Uploader Security Update - Codecov](https://about.codecov.io/security-update/)

This supply chain attack affects to CI like Circle CI, GitHub Actions.

GitHub Actions can limit each actions's permissions.

For example, next `permissios` only allow the action to read repo's content.

```yaml
permissions:
	contents: read
```

The default `permissions` is `write-all`.
Of course, you can change the default workflow permission of the repository.

- [Disabling or limiting GitHub Actions for a repository - GitHub Docs](https://docs.github.com/en/github/administering-a-repository/managing-repository-settings/disabling-or-limiting-github-actions-for-a-repository#enabling-workflows-for-private-repository-forks)
- [Security hardening for GitHub Actions - GitHub Docs](https://docs.github.com/en/actions/learn-github-actions/security-hardening-for-github-actions)

So, you need to do following to improve security of GitHub Actions.

- Change the default permissiont to "Read repository contents permission "
- Write each actions's `permissions` to yaml files

However, `permissions` is optional and it is a little of hard to set. Because, almost actions does not provides `permissions` guide.

## [@pkgdeps/update-github-actions-permissions](https://github.com/pkgdeps/update-github-actions-permissions)

I've created a tool that update GitHub Actions's permissions automatically.

This tools detect using Actions and add permissions field to your action yaml file.

**Requirements**: Node.js 14+

You can update your GitHub Actions via following command:

```bash
npx @pkgdeps/update-github-actions-permissions ".github/workflows/*.{yaml,yml}"
```

![update-github-actions-permissions result](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/x0b72ti0m9whu3lht5uv.png)

This tool supports [40+ actions](https://github.com/pkgdeps/update-github-actions-permissions/blob/main/actions.yml).

If you found missing actions, please submit a pull request.

- [pkgdeps/update-github-actions-permissions: A CLI that update GitHub Actions's `permissions` automatically](https://github.com/pkgdeps/update-github-actions-permissions)

## Related

- [secretlint v3.0 support GitHub’s new authentication token detection - DEV Community 👩‍💻👨‍💻](https://dev.to/azu/secretlint-v3-0-support-github-token-detection-57eg)