From 4ae8d8faa79d6dbf9ae78f8d366a66ae85ee45ec Mon Sep 17 00:00:00 2001 From: Daniel George Holz Date: Wed, 17 Feb 2021 12:49:17 +0000 Subject: [PATCH 1/4] Call out how PATs with `write:packages` scope also require `repo` scope --- .../authenticate_with_pat_for_container_registry.md | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/data/reusables/package_registry/authenticate_with_pat_for_container_registry.md b/data/reusables/package_registry/authenticate_with_pat_for_container_registry.md index 3e1785682385..8a9304385a5d 100644 --- a/data/reusables/package_registry/authenticate_with_pat_for_container_registry.md +++ b/data/reusables/package_registry/authenticate_with_pat_for_container_registry.md @@ -1,7 +1,13 @@ {% if currentVersion == "free-pro-team@latest" %} If you want to authenticate to {% data variables.product.prodname_github_container_registry %} in a {% data variables.product.prodname_actions %} workflow, then you must use a personal access token (PAT). The `GITHUB_TOKEN` does not currently have the required permissions. During the {% data variables.product.prodname_github_container_registry %} beta, the only supported form of authentication is the PAT. -PATs can grant broad access to your account. We recommend selecting only the necessary read, write, or delete `package` scope when creating a PAT to authenticate to the {% data variables.product.prodname_container_registry %}. Avoid including the `repo` scope in a PAT used by a GitHub Actions workflow because it gives unnecessary additional access. +PATs can grant broad access to your account. You should select only the necessary `read:packages`, `write:packages`, or `delete:packages` scope when creating a PAT to authenticate to the {% data variables.product.prodname_container_registry %}. + +{% warning %} + +**Note:** Granting the `write:packages` scope on the PAT also grants the `repo` scope! If you save this PAT for use from an Action, any collaborators can configure an Actions workflow to use this PAT to get full permissions to all repositories accessable from the PAT owner's account. We recommend creating a separate account with access only to the specific repositories that want to push Docker images (see "[Security hardening for GitHub Actions](/actions/getting-started-with-github-actions/security-hardening-for-github-actions#considering-cross-repository-access)"). + +{% endwarning %} If you'd like to use the {% data variables.product.prodname_container_registry %} in actions during the beta, follow our security best practices for PAT use at "[Security hardening for GitHub Actions](/actions/getting-started-with-github-actions/security-hardening-for-github-actions#considering-cross-repository-access)." From 68496a6368d71dbace97c2ce453dcf46ebd93251 Mon Sep 17 00:00:00 2001 From: Daniel George Holz Date: Wed, 17 Feb 2021 12:50:42 +0000 Subject: [PATCH 2/4] Call out how `write:packages` implies `repo` on a PAT --- .../authenticate-to-container-registry-steps.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/data/reusables/package_registry/authenticate-to-container-registry-steps.md b/data/reusables/package_registry/authenticate-to-container-registry-steps.md index bc748abafc20..a6883363b6b0 100644 --- a/data/reusables/package_registry/authenticate-to-container-registry-steps.md +++ b/data/reusables/package_registry/authenticate-to-container-registry-steps.md @@ -1,7 +1,7 @@ 1. Create a new personal access token (PAT) with the appropriate scopes for the tasks you want to accomplish. If your organization requires SSO, you must enable SSO for your new token. {% warning %} - **Note:** If you select the `write:packages` scope, deselect the `repo` scope when creating the PAT. Adding a PAT with the `repo` scope as a secret in your repository allows the credential to be accessible to all collaborators in the repository. This gives unnecessary additional access when a PAT with the `repo` scope is used within an action. For more information on security best practices for actions, see "[Security hardening for GitHub Actions](/actions/getting-started-with-github-actions/security-hardening-for-github-actions#considering-cross-repository-access)." + **Note:** Granting the `write:packages` scope on the PAT also grants the `repo` scope! If you save this PAT for use from an Action, any collaborators can configure an Actions workflow to use this PAT to get full permissions to all repositories accessable from the PAT owner's account. We recommend creating a separate account with access only to the specific repositories that want to push Docker images (see "[Security hardening for GitHub Actions](/actions/getting-started-with-github-actions/security-hardening-for-github-actions#considering-cross-repository-access)"). {% endwarning %} From ada9718306805a449fbe2cdc9cb1969d3df88258 Mon Sep 17 00:00:00 2001 From: jmarlena <6732600+jmarlena@users.noreply.github.com> Date: Tue, 30 Mar 2021 21:32:20 -0700 Subject: [PATCH 3/4] Apply suggestions from code review --- .../authenticate-to-container-registry-steps.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/data/reusables/package_registry/authenticate-to-container-registry-steps.md b/data/reusables/package_registry/authenticate-to-container-registry-steps.md index a6883363b6b0..d5e173f71e74 100644 --- a/data/reusables/package_registry/authenticate-to-container-registry-steps.md +++ b/data/reusables/package_registry/authenticate-to-container-registry-steps.md @@ -1,7 +1,7 @@ 1. Create a new personal access token (PAT) with the appropriate scopes for the tasks you want to accomplish. If your organization requires SSO, you must enable SSO for your new token. {% warning %} - **Note:** Granting the `write:packages` scope on the PAT also grants the `repo` scope! If you save this PAT for use from an Action, any collaborators can configure an Actions workflow to use this PAT to get full permissions to all repositories accessable from the PAT owner's account. We recommend creating a separate account with access only to the specific repositories that want to push Docker images (see "[Security hardening for GitHub Actions](/actions/getting-started-with-github-actions/security-hardening-for-github-actions#considering-cross-repository-access)"). + **Note:** By default, when you select the `write:packages` scope for your personal access token (PAT) in the user interface, the `repo` scope will also be selected. The `repo` scope offers unnecessary and broad access, which we recommend you avoid using for GitHub Actions workflows in particular. For more information, see "[Security hardening for GitHub Actions](/actions/getting-started-with-github-actions/security-hardening-for-github-actions#considering-cross-repository-access)." As a workaround, you can select just the `write:packages` scope for your PAT in the user interface with this url: `https://github.com/settings/tokens/new?scopes=write:packages`. {% endwarning %} From e60b9505c0cb1545a4007f8cb9d63611a1c3eef4 Mon Sep 17 00:00:00 2001 From: jmarlena <6732600+jmarlena@users.noreply.github.com> Date: Tue, 30 Mar 2021 21:39:52 -0700 Subject: [PATCH 4/4] Apply suggestions from code review --- .../authenticate_with_pat_for_container_registry.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/data/reusables/package_registry/authenticate_with_pat_for_container_registry.md b/data/reusables/package_registry/authenticate_with_pat_for_container_registry.md index 8a9304385a5d..37224f712eab 100644 --- a/data/reusables/package_registry/authenticate_with_pat_for_container_registry.md +++ b/data/reusables/package_registry/authenticate_with_pat_for_container_registry.md @@ -5,7 +5,11 @@ PATs can grant broad access to your account. You should select only the necessar {% warning %} -**Note:** Granting the `write:packages` scope on the PAT also grants the `repo` scope! If you save this PAT for use from an Action, any collaborators can configure an Actions workflow to use this PAT to get full permissions to all repositories accessable from the PAT owner's account. We recommend creating a separate account with access only to the specific repositories that want to push Docker images (see "[Security hardening for GitHub Actions](/actions/getting-started-with-github-actions/security-hardening-for-github-actions#considering-cross-repository-access)"). +**Note:** * By default, when you select the `write:packages` scope for your personal access token (PAT) in the user interface, the `repo` scope will also be selected. The `repo` scope offers unnecessary and broad access, which we recommend you avoid using for GitHub Actions workflows in particular. + +If you save this PAT for use from an action, any collaborators can configure a GitHub Actions workflow to use this PAT to get full permissions to all repositories accessible from the PAT owner's account. For more information, see "[Security hardening for GitHub Actions](/actions/getting-started-with-github-actions/security-hardening-for-github-actions#considering-cross-repository-access)." + +As a workaround, you can select just the `write:packages` scope for your PAT in the user interface with this url: `https://github.com/settings/tokens/new?scopes=write:packages` and other desired scopes such as the `delete: packages` scope. Or you can create a separate account with access only to specific repositories that push Docker images. {% endwarning %}