feat: Add configurable permissions for Actions automatic tokens #36173
Conversation
GiteaBot
added
the
lgtm/need 2
github-actions
bot
added
modifies/translation
modifies/go
|
@lunny @wxiaoguang Please review this |
|
Thank you for asking me to review, but I don't use Actions. You can invite the maintainers from the original issue to review. |
@silverwind Please review |
|
I review mostly frontend stuff and am not much of an actions user myself, so please be patient until someone finds time to review it properly. |
No problem |
| ctx.Data["TokenPermissionModePermissive"] = repo_model.ActionsTokenPermissionModePermissive | ||
| ctx.Data["TokenPermissionModeRestricted"] = repo_model.ActionsTokenPermissionModeRestricted | ||
| ctx.Data["EffectiveTokenPermissions"] = actionsCfg.GetEffectiveTokenPermissions(false) | ||
| ctx.Data["MaxTokenPermissions"] = actionsCfg.GetMaxTokenPermissions() |
There was a problem hiding this comment.
EffectiveTokenPermissions and MaxTokenPermissions are not being used on the frontend page. Should they be removed?
| permissionMode := ctx.FormString("token_permission_mode") | ||
| if permissionMode == string(repo_model.ActionsTokenPermissionModeRestricted) { | ||
| actionsCfg.TokenPermissionMode = repo_model.ActionsTokenPermissionModeRestricted | ||
| } else { |
There was a problem hiding this comment.
When permissionMode is not "permissive" or "restricted", it's better to return 400 Bad Request
| }) | ||
| } | ||
|
|
||
| func testActionsTokenPermissionsMode(u *url.URL, mode string, expectReadOnly bool) func(t *testing.T) { |
There was a problem hiding this comment.
mode and expectReadOnly params are unused, is this as expected?
|
By the way, I see another (older) PR: Feat/actions token permissions #36113 , it added more than 2000 lines of code. What are the differences? Which PR would win ....... @Zettat123 |
This PR doesn't fully implement the proposal in #24635. (For example, it doesn't support configuring actions access between repositories in the same organization) It seems that #36113 implemented these features, but I think its code needs improvement. |
5 participants
Summary
Implements Issue #24635 - Support configuring permissions of automatic tokens for Actions jobs.
This PR adds the ability to configure the default permissions granted to the GITHUB_TOKEN when running workflow jobs in a repository. Users can now choose between:
Changes
Backend
Extended
ActionsConfigstruct inmodels/repo/repo_unit.gowith:ActionsTokenPermissionModetype (permissive/restricted)ActionsTokenPermissionsstruct for per-unit permissions (Contents, Issues, PullRequests, Packages, Actions, Wiki)Modified
GetActionsUserRepoPermissioninmodels/perm/access/repo_permission.goto use configurable per-unit permissions instead of hardcoded access modesAdded
UpdateTokenPermissionshandler inrouters/web/repo/setting/actions.goFrontend
options/locale/locale_en-US.iniTests
models/repo/repo_unit_test.gofor token permission methodsTestActionsTokenPermissionsModesintests/integration/actions_job_token_test.goScreenshots
The new Token Permissions section appears in Settings → Actions → General:
Notes
Related Issues
Closes #24635
/claim #24635