Skip to content

Commit 6748d81

Browse files
ajaykngithub-actionsSiaraMist
authored
[Actions] Adding packages:read to default Github token (github#34332)
Co-authored-by: github-actions <[email protected]> Co-authored-by: Siara <[email protected]>
1 parent 0ab649b commit 6748d81

File tree

7 files changed

+35
-15
lines changed

7 files changed

+35
-15
lines changed

‎assets/images/help/settings/actions-workflow-permissions-enterprise-with-default-restrictive.png

129 KB
Loading

‎assets/images/help/settings/actions-workflow-permissions-organization-with-default-restrictive.png

128 KB
Loading

‎assets/images/help/settings/actions-workflow-permissions-repository-with-default-restrictive.png

111 KB
Loading

‎content/actions/security-guides/automatic-token-authentication.md

+2-2
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,7 @@ jobs:
5656
create_issue:
5757
runs-on: ubuntu-latest
5858
permissions:
59-
issues: write
59+
issues: write
6060
steps:
6161
- name: Create issue using REST API
6262
run: |
@@ -86,7 +86,7 @@ The following table shows the permissions granted to the `GITHUB_TOKEN` by defau
8686
| id-token | none | none | read |{% endif %}
8787
| issues | read/write | none | read |
8888
| metadata | read | read | read |
89-
| packages | read/write | none | read |
89+
| packages | read/write | {% ifversion actions-default-workflow-permissions-restrictive %}read{% else %}none{% endif %} | read |
9090
| pages | read/write | none | read |
9191
| pull-requests | read/write | none | read |
9292
| repository-projects | read/write | none | read |

‎content/admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise.md

+10-2
Original file line numberDiff line numberDiff line change
@@ -129,16 +129,20 @@ You can set the default permissions for the `GITHUB_TOKEN` in the settings for y
129129
### Configuring the default `GITHUB_TOKEN` permissions
130130

131131
{% ifversion actions-default-workflow-permissions-restrictive %}
132-
By default, when you create a new enterprise, `GITHUB_TOKEN` only has read access for the `contents` scope.
132+
By default, when you create a new enterprise, `GITHUB_TOKEN` only has read access for the `contents` and `packages` scopes.
133133
{% endif %}
134134

135135
{% data reusables.enterprise-accounts.access-enterprise %}
136136
{% data reusables.enterprise-accounts.policies-tab %}
137137
{% data reusables.enterprise-accounts.actions-tab %}
138-
1. Under "Workflow permissions", choose whether you want the `GITHUB_TOKEN` to have read and write access for all scopes, or just read access for the `contents` scope.
138+
1. Under "Workflow permissions", choose whether you want the `GITHUB_TOKEN` to have read and write access for all scopes, or just read access for the `contents` {% ifversion actions-default-workflow-permissions-restrictive %}and `packages` scopes{% else %}scope{% endif %}.
139139

140140
{% ifversion allow-actions-to-approve-pr-with-ent-repo %}
141+
{% ifversion actions-default-workflow-permissions-restrictive %}
142+
![Set GITHUB_TOKEN permissions for this enterprise](/assets/images/help/settings/actions-workflow-permissions-enterprise-with-default-restrictive.png)
143+
{% else %}
141144
![Set GITHUB_TOKEN permissions for this enterprise](/assets/images/help/settings/actions-workflow-permissions-enterprise-with-pr-approval.png)
145+
{% endif %}
142146
{% else %}
143147
![Set GITHUB_TOKEN permissions for this enterprise](/assets/images/help/settings/actions-workflow-permissions-enterprise.png)
144148
{% endif %}
@@ -158,7 +162,11 @@ By default, when you create a new enterprise, workflows are not allowed to creat
158162
{% data reusables.enterprise-accounts.actions-tab %}
159163
1. Under "Workflow permissions", use the **Allow GitHub Actions to create and approve pull requests** setting to configure whether `GITHUB_TOKEN` can create and approve pull requests.
160164

165+
{% ifversion actions-default-workflow-permissions-restrictive %}
166+
![Set GITHUB_TOKEN permissions for this enterprise](/assets/images/help/settings/actions-workflow-permissions-enterprise-with-default-restrictive.png)
167+
{% else %}
161168
![Set GITHUB_TOKEN permissions for this enterprise](/assets/images/help/settings/actions-workflow-permissions-enterprise-with-pr-approval.png)
169+
{% endif %}
162170
1. Click **Save** to apply the settings.
163171

164172
{% endif %}

‎content/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization.md

+13-8
Original file line numberDiff line numberDiff line change
@@ -160,23 +160,27 @@ You can set the default permissions for the `GITHUB_TOKEN` in the settings for y
160160
### Configuring the default `GITHUB_TOKEN` permissions
161161

162162
{% ifversion actions-default-workflow-permissions-restrictive %}
163-
By default, when you create a new organization,{% ifversion ghec or ghes or ghae %} the setting is inherited from what is configured in the enterprise settings.{% else %} `GITHUB_TOKEN` only has read access for the `contents` scope.{% endif %}
163+
By default, when you create a new organization,{% ifversion ghec or ghes or ghae %} the setting is inherited from what is configured in the enterprise settings.{% else %} `GITHUB_TOKEN` only has read access for the `contents` and `packages` scopes.{% endif %}
164164
{% endif %}
165165

166166
{% data reusables.profile.access_profile %}
167167
{% data reusables.profile.access_org %}
168168
{% data reusables.profile.org_settings %}
169169
{% data reusables.organizations.settings-sidebar-actions-general %}
170-
1. Under "Workflow permissions", choose whether you want the `GITHUB_TOKEN` to have read and write access for all scopes, or just read access for the `contents` scope.
170+
1. Under "Workflow permissions", choose whether you want the `GITHUB_TOKEN` to have read and write access for all scopes, or just read access for the `contents` {% ifversion actions-default-workflow-permissions-restrictive %}and `packages` scopes{% else %}scope{% endif %}.
171171

172172
{% ifversion allow-actions-to-approve-pr %}
173173
{% ifversion allow-actions-to-approve-pr-with-ent-repo %}
174+
{% ifversion actions-default-workflow-permissions-restrictive %}
175+
![Set GITHUB_TOKEN permissions for this organization](/assets/images/help/settings/actions-workflow-permissions-organization-with-default-restrictive.png)
176+
{% else %}
174177
![Set GITHUB_TOKEN permissions for this organization](/assets/images/help/settings/actions-workflow-permissions-organization-with-pr-creation-approval.png)
178+
{% endif %}
175179
{% else %}
176180
![Set GITHUB_TOKEN permissions for this organization](/assets/images/help/settings/actions-workflow-permissions-organization-with-pr-approval.png)
177181
{% endif %}
178182
{% else %}
179-
![Set GITHUB_TOKEN permissions for this organization](/assets/images/help/settings/actions-workflow-permissions-organization-with-pr-approval.png)
183+
![Set GITHUB_TOKEN permissions for this organization](/assets/images/help/settings/actions-workflow-permissions-organization.png)
180184
{% endif %}
181185
1. Click **Save** to apply the settings.
182186

@@ -193,15 +197,16 @@ By default, when you create a new organization, workflows are not allowed to {%
193197
{% data reusables.organizations.settings-sidebar-actions-general %}
194198
1. Under "Workflow permissions", use the **Allow GitHub Actions to {% ifversion allow-actions-to-approve-pr-with-ent-repo %}create and {% endif %}approve pull requests** setting to configure whether `GITHUB_TOKEN` can {% ifversion allow-actions-to-approve-pr-with-ent-repo %}create and {% endif %}approve pull requests.
195199

196-
{% ifversion allow-actions-to-approve-pr %}
197-
{% ifversion allow-actions-to-approve-pr-with-ent-repo %}
198-
![Set GITHUB_TOKEN pull request approval permission for this organization](/assets/images/help/settings/actions-workflow-permissions-organization-with-pr-creation-approval.png)
200+
{% ifversion allow-actions-to-approve-pr-with-ent-repo %}
201+
{% ifversion actions-default-workflow-permissions-restrictive %}
202+
![Set GITHUB_TOKEN permissions for this organization](/assets/images/help/settings/actions-workflow-permissions-organization-with-default-restrictive.png)
199203
{% else %}
200-
![Set GITHUB_TOKEN pull request approval permission for this organization](/assets/images/help/settings/actions-workflow-permissions-organization-with-pr-approval.png)
204+
![Set GITHUB_TOKEN pull request approval permission for this organization](/assets/images/help/settings/actions-workflow-permissions-organization-with-pr-creation-approval.png)
201205
{% endif %}
202206
{% else %}
203-
![Set GITHUB_TOKEN pull request approval permission for this organization](/assets/images/help/settings/actions-workflow-permissions-organization.png)
207+
![Set GITHUB_TOKEN pull request approval permission for this organization](/assets/images/help/settings/actions-workflow-permissions-organization-with-pr-approval.png)
204208
{% endif %}
209+
205210
1. Click **Save** to apply the settings.
206211

207212
{% endif %}

‎content/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository.md

+10-3
Original file line numberDiff line numberDiff line change
@@ -112,20 +112,23 @@ The default permissions can also be configured in the organization settings. If
112112
### Configuring the default `GITHUB_TOKEN` permissions
113113

114114
{% ifversion actions-default-workflow-permissions-restrictive %}
115-
By default, when you create a new repository in your personal account, `GITHUB_TOKEN` only has read access for the `contents` scope. If you create a new repository in an organization, the setting is inherited from what is configured in the organization settings.
115+
By default, when you create a new repository in your personal account, `GITHUB_TOKEN` only has read access for the `contents` and `packages` scopes. If you create a new repository in an organization, the setting is inherited from what is configured in the organization settings.
116116
{% endif %}
117117

118118
{% data reusables.repositories.navigate-to-repo %}
119119
{% data reusables.repositories.sidebar-settings %}
120120
{% data reusables.repositories.settings-sidebar-actions-general %}
121-
1. Under "Workflow permissions", choose whether you want the `GITHUB_TOKEN` to have read and write access for all scopes, or just read access for the `contents` scope.
121+
1. Under "Workflow permissions", choose whether you want the `GITHUB_TOKEN` to have read and write access for all scopes, or just read access for the `contents` {% ifversion actions-default-workflow-permissions-restrictive %}and `packages` scopes{% else %}scope{% endif %}.
122122

123123
{% ifversion allow-actions-to-approve-pr-with-ent-repo %}
124+
{% ifversion actions-default-workflow-permissions-restrictive %}
125+
![Set GITHUB_TOKEN permissions for this repository](/assets/images/help/settings/actions-workflow-permissions-repository-with-default-restrictive.png)
126+
{% else %}
124127
![Set GITHUB_TOKEN permissions for this repository](/assets/images/help/settings/actions-workflow-permissions-repository-with-pr-approval.png)
128+
{% endif %}
125129
{% else %}
126130
![Set GITHUB_TOKEN permissions for this repository](/assets/images/help/settings/actions-workflow-permissions-repository.png)
127131
{% endif %}
128-
129132
1. Click **Save** to apply the settings.
130133

131134
{% ifversion allow-actions-to-approve-pr-with-ent-repo %}
@@ -142,7 +145,11 @@ By default, when you create a new repository in your personal account, workflows
142145
{% data reusables.repositories.settings-sidebar-actions-general %}
143146
1. Under "Workflow permissions", use the **Allow GitHub Actions to create and approve pull requests** setting to configure whether `GITHUB_TOKEN` can create and approve pull requests.
144147

148+
{% ifversion actions-default-workflow-permissions-restrictive %}
149+
![Set GITHUB_TOKEN permissions for this repository](/assets/images/help/settings/actions-workflow-permissions-repository-with-default-restrictive.png)
150+
{% else %}
145151
![Set GITHUB_TOKEN permissions for this repository](/assets/images/help/settings/actions-workflow-permissions-repository-with-pr-approval.png)
152+
{% endif %}
146153
1. Click **Save** to apply the settings.
147154
{% endif %}
148155

0 commit comments

Comments
 (0)