Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Runners do not log the id-token permission #3268

Open
TapdancingRodent opened this issue Apr 30, 2024 · 0 comments
Open

Runners do not log the id-token permission #3268

TapdancingRodent opened this issue Apr 30, 2024 · 0 comments
Labels
bug Something isn't working

Comments

@TapdancingRodent
Copy link

TapdancingRodent commented Apr 30, 2024

Disclaimer
Please point me elsewhere if this isn't the right place to raise this. It seems like the runner only dumps a map it gets from the job context but I couldn't find where system.github.token.permissions is managed.

Describe the bug
When a workflow sets the id-token permission the logs do not include it when reporting what permissions the GITHUB_TOKEN had. This is undesirable from a security and auditing perspective.

Related, but less important: the Attestations [edit: it looks like this was released yesterday] and Discussions permissions which are logged do not appear to be documented.

To Reproduce
Add the below permissions block to a workflow (e.g. a simple example)

    permissions:
      id-token: write

and check the logs of the workflow run to see that the permissions are reported as

GITHUB_TOKEN Permissions
  Metadata: read

Expected behavior
The logs would include (for instance)

GITHUB_TOKEN Permissions
  IdToken: write
  Metadata: read

Runner Version and Platform

This was tested on self-hosted runners in an EMU instance and on GitHub runners in a public repository. The reported version from the public repository are

Current runner version: '2.316.0'
Operating System
  Ubuntu
  [2](https://github.com/TapdancingRodent/stunning-octo-potato/actions/runs/8894662891/job/24423388853#step:1:2)2.04.4
  LTS
Runner Image
  Image: ubuntu-22.04
  Version: 20240422.1.0
  Included Software: https://github.com/actions/runner-images/blob/ubuntu22/20240422.1/images/ubuntu/Ubuntu2204-Readme.md
  Image Release: https://github.com/actions/runner-images/releases/tag/ubuntu22%2F20240422.1
Runner Image Provisioner
  2.0.[3](https://github.com/TapdancingRodent/stunning-octo-potato/actions/runs/8894662891/job/24423388853#step:1:3)69.1

What's not working?

See report body above

Job Log Output

See report body above

Runner and Worker's Diagnostic Logs

N/A

@TapdancingRodent TapdancingRodent added the bug Something isn't working label Apr 30, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

1 participant