René's URL Explorer Experiment


Title: GitHub Workflows security hardening by sashashura · Pull Request #96492 · python/cpython · GitHub

Open Graph Title: GitHub Workflows security hardening by sashashura · Pull Request #96492 · python/cpython

X Title: GitHub Workflows security hardening by sashashura · Pull Request #96492 · python/cpython

Description: This PR adds explicit permissions section to workflows. This is a security best practice because by default workflows run with extended set of permissions (except from on: pull_request from externa...

Open Graph Description: This PR adds explicit permissions section to workflows. This is a security best practice because by default workflows run with extended set of permissions (except from on: pull_request from externa...

X Description: This PR adds explicit permissions section to workflows. This is a security best practice because by default workflows run with extended set of permissions (except from on: pull_request from externa...

Opengraph URL: https://github.com/python/cpython/pull/96492

X: @github

direct link

Domain: github.com

route-pattern/_view_fragments/voltron/pull_requests/show/:user_id/:repository/:id/pull_request_layout(.:format)
route-controllervoltron_pull_requests_fragments
route-actionpull_request_layout
fetch-noncev2:0cc12fa5-ce39-dc7b-054c-88a73cf5466a
current-catalog-service-hashae870bc5e265a340912cde392f23dad3671a0a881730ffdadd82f2f57d81641b
request-idED08:36C7A:749356:9C0E85:6969786F
html-safe-nonceaa8b633886ab61da230c9fa1f6eb86fe09a17dc4f3feee9c3d0d278df4591b3f
visitor-payloadeyJyZWZlcnJlciI6IiIsInJlcXVlc3RfaWQiOiJFRDA4OjM2QzdBOjc0OTM1Njo5QzBFODU6Njk2OTc4NkYiLCJ2aXNpdG9yX2lkIjoiNDA4NzQ4MzIyMTYwOTY0MjA5NSIsInJlZ2lvbl9lZGdlIjoiaWFkIiwicmVnaW9uX3JlbmRlciI6ImlhZCJ9
visitor-hmac67d84fb12c7e24ebc0f421bc8738b52d3db02439a75eb0e08d11f0192bb6ee1b
hovercard-subject-tagpull_request:1044248728
github-keyboard-shortcutsrepository,pull-request-list,pull-request-conversation,pull-request-files-changed,copilot
google-site-verificationApib7-x98H0j5cPqHWwSMm6dNU4GmODRoqxLiDzdx9I
octolytics-urlhttps://collector.github.com/github/collect
analytics-location///voltron/pull_requests_fragments/pull_request_layout
fb:app_id1401488693436528
apple-itunes-appapp-id=1477376905, app-argument=https://github.com/_view_fragments/voltron/pull_requests/show/python/cpython/96492/pull_request_layout
twitter:imagehttps://opengraph.githubassets.com/0be0374bc3c855cb73d8ad77cc1ae7139b6dd703ec35cf8f6029888745659593/python/cpython/pull/96492
twitter:cardsummary_large_image
og:imagehttps://opengraph.githubassets.com/0be0374bc3c855cb73d8ad77cc1ae7139b6dd703ec35cf8f6029888745659593/python/cpython/pull/96492
og:image:altThis PR adds explicit permissions section to workflows. This is a security best practice because by default workflows run with extended set of permissions (except from on: pull_request from externa...
og:image:width1200
og:image:height600
og:site_nameGitHub
og:typeobject
og:author:usernamesashashura
hostnamegithub.com
expected-hostnamegithub.com
Nonec6f193beb8ff08443adc07685d75302ab8aaf0a135f6e251c3ff3112c8deb881
turbo-cache-controlno-preview
go-importgithub.com/python/cpython git https://github.com/python/cpython.git
octolytics-dimension-user_id1525981
octolytics-dimension-user_loginpython
octolytics-dimension-repository_id81598961
octolytics-dimension-repository_nwopython/cpython
octolytics-dimension-repository_publictrue
octolytics-dimension-repository_is_forkfalse
octolytics-dimension-repository_network_root_id81598961
octolytics-dimension-repository_network_root_nwopython/cpython
turbo-body-classeslogged-out env-production page-responsive
disable-turbofalse
browser-stats-urlhttps://api.github.com/_private/browser/stats
browser-errors-urlhttps://api.github.com/_private/browser/errors
release212e3e3d3298bf5b313830edfd2399e869f7ea76
ui-targetfull
theme-color#1e2327
color-schemelight dark

Links:

Skip to contenthttps://github.com/python/cpython/pull/96492#start-of-content
https://github.com/
Sign in https://github.com/login?return_to=https%3A%2F%2Fgithub.com%2Fpython%2Fcpython%2Fpull%2F96492
GitHub CopilotWrite better code with AIhttps://github.com/features/copilot
GitHub SparkBuild and deploy intelligent appshttps://github.com/features/spark
GitHub ModelsManage and compare promptshttps://github.com/features/models
MCP RegistryNewIntegrate external toolshttps://github.com/mcp
ActionsAutomate any workflowhttps://github.com/features/actions
CodespacesInstant dev environmentshttps://github.com/features/codespaces
IssuesPlan and track workhttps://github.com/features/issues
Code ReviewManage code changeshttps://github.com/features/code-review
GitHub Advanced SecurityFind and fix vulnerabilitieshttps://github.com/security/advanced-security
Code securitySecure your code as you buildhttps://github.com/security/advanced-security/code-security
Secret protectionStop leaks before they starthttps://github.com/security/advanced-security/secret-protection
Why GitHubhttps://github.com/why-github
Documentationhttps://docs.github.com
Bloghttps://github.blog
Changeloghttps://github.blog/changelog
Marketplacehttps://github.com/marketplace
View all featureshttps://github.com/features
Enterpriseshttps://github.com/enterprise
Small and medium teamshttps://github.com/team
Startupshttps://github.com/enterprise/startups
Nonprofitshttps://github.com/solutions/industry/nonprofits
App Modernizationhttps://github.com/solutions/use-case/app-modernization
DevSecOpshttps://github.com/solutions/use-case/devsecops
DevOpshttps://github.com/solutions/use-case/devops
CI/CDhttps://github.com/solutions/use-case/ci-cd
View all use caseshttps://github.com/solutions/use-case
Healthcarehttps://github.com/solutions/industry/healthcare
Financial serviceshttps://github.com/solutions/industry/financial-services
Manufacturinghttps://github.com/solutions/industry/manufacturing
Governmenthttps://github.com/solutions/industry/government
View all industrieshttps://github.com/solutions/industry
View all solutionshttps://github.com/solutions
AIhttps://github.com/resources/articles?topic=ai
Software Developmenthttps://github.com/resources/articles?topic=software-development
DevOpshttps://github.com/resources/articles?topic=devops
Securityhttps://github.com/resources/articles?topic=security
View all topicshttps://github.com/resources/articles
Customer storieshttps://github.com/customer-stories
Events & webinarshttps://github.com/resources/events
Ebooks & reportshttps://github.com/resources/whitepapers
Business insightshttps://github.com/solutions/executive-insights
GitHub Skillshttps://skills.github.com
Documentationhttps://docs.github.com
Customer supporthttps://support.github.com
Community forumhttps://github.com/orgs/community/discussions
Trust centerhttps://github.com/trust-center
Partnershttps://github.com/partners
GitHub SponsorsFund open source developershttps://github.com/sponsors
Security Labhttps://securitylab.github.com
Maintainer Communityhttps://maintainers.github.com
Acceleratorhttps://github.com/accelerator
Archive Programhttps://archiveprogram.github.com
Topicshttps://github.com/topics
Trendinghttps://github.com/trending
Collectionshttps://github.com/collections
Enterprise platformAI-powered developer platformhttps://github.com/enterprise
GitHub Advanced SecurityEnterprise-grade security featureshttps://github.com/security/advanced-security
Copilot for BusinessEnterprise-grade AI featureshttps://github.com/features/copilot/copilot-business
Premium SupportEnterprise-grade 24/7 supporthttps://github.com/premium-support
Pricinghttps://github.com/pricing
Search syntax tipshttps://docs.github.com/search-github/github-code-search/understanding-github-code-search-syntax
documentationhttps://docs.github.com/search-github/github-code-search/understanding-github-code-search-syntax
Sign in https://github.com/login?return_to=https%3A%2F%2Fgithub.com%2Fpython%2Fcpython%2Fpull%2F96492
Sign up https://github.com/signup?ref_cta=Sign+up&ref_loc=header+logged+out&ref_page=%2F%3Cuser-name%3E%2F%3Crepo-name%3E%2Fvoltron%2Fpull_requests_fragments%2Fpull_request_layout&source=header-repo&source_repo=python%2Fcpython
Reloadhttps://github.com/python/cpython/pull/96492
Reloadhttps://github.com/python/cpython/pull/96492
Reloadhttps://github.com/python/cpython/pull/96492
python https://github.com/python
cpythonhttps://github.com/python/cpython
Please reload this pagehttps://github.com/python/cpython/pull/96492
Notifications https://github.com/login?return_to=%2Fpython%2Fcpython
Fork 33.9k https://github.com/login?return_to=%2Fpython%2Fcpython
Star 71.1k https://github.com/login?return_to=%2Fpython%2Fcpython
Code https://github.com/python/cpython
Issues 5k+ https://github.com/python/cpython/issues
Pull requests 2.1k https://github.com/python/cpython/pulls
Actions https://github.com/python/cpython/actions
Projects 31 https://github.com/python/cpython/projects
Security Uh oh! There was an error while loading. Please reload this page. https://github.com/python/cpython/security
Please reload this pagehttps://github.com/python/cpython/pull/96492
Insights https://github.com/python/cpython/pulse
Code https://github.com/python/cpython
Issues https://github.com/python/cpython/issues
Pull requests https://github.com/python/cpython/pulls
Actions https://github.com/python/cpython/actions
Projects https://github.com/python/cpython/projects
Security https://github.com/python/cpython/security
Insights https://github.com/python/cpython/pulse
Sign up for GitHub https://github.com/signup?return_to=%2Fpython%2Fcpython%2Fissues%2Fnew%2Fchoose
terms of servicehttps://docs.github.com/terms
privacy statementhttps://docs.github.com/privacy
Sign inhttps://github.com/login?return_to=%2Fpython%2Fcpython%2Fissues%2Fnew%2Fchoose
Jump to bottomhttps://github.com/python/cpython/pull/96492#issue-comment-box
ezio-melottihttps://github.com/ezio-melotti
python:mainhttps://github.com/python/cpython/tree/main
sashashura:patch-1https://github.com/sashashura/cpython/tree/patch-1
GitHub Workflows security hardening https://github.com/python/cpython/pull/96492#top
ezio-melottihttps://github.com/ezio-melotti
python:mainhttps://github.com/python/cpython/tree/main
sashashura:patch-1https://github.com/sashashura/cpython/tree/patch-1
Conversation 9 https://github.com/python/cpython/pull/96492
Commits 2 https://github.com/python/cpython/pull/96492/commits
Checks 0 https://github.com/python/cpython/pull/96492/checks
Files changed https://github.com/python/cpython/pull/96492/files
Please reload this pagehttps://github.com/python/cpython/pull/96492
https://github.co/hiddenchars
https://github.com/python/cpython/pull/{{ revealButtonHref }}
https://github.com/sashashura
sashashurahttps://github.com/sashashura
Sep 1, 2022https://github.com/python/cpython/pull/96492#issue-1359428270
permissions sectionhttps://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
extended set of permissionshttps://docs.github.com/en/actions/security-guides/automatic-token-authentication#permissions-for-the-github_token
from external forkshttps://securitylab.github.com/research/github-actions-preventing-pwn-requests/
injectionhttps://securitylab.github.com/research/github-actions-untrusted-input/
most strict permissions on the top levelhttps://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions
job levelhttps://docs.github.com/en/actions/using-jobs/assigning-permissions-to-jobs
Please reload this pagehttps://github.com/python/cpython/pull/96492
https://github.com/sashashura
Update project-updater.ymlhttps://github.com/python/cpython/pull/96492/commits/9b91badc6d9fb0999318246a2a86bdcb3035861c
9b91badhttps://github.com/python/cpython/pull/96492/commits/9b91badc6d9fb0999318246a2a86bdcb3035861c
https://github.com/ghost
ghosthttps://github.com/ghost
Sep 1, 2022https://github.com/python/cpython/pull/96492#issuecomment-1234801158
Please reload this pagehttps://github.com/python/cpython/pull/96492
https://cpython-clabot.herokuapp.com/signed-contributor-license-agreement?version=96a49432b8b111ec9bf5bfe9ad6c72c4
Please reload this pagehttps://github.com/python/cpython/pull/96492
https://github.com/bedevere-bot
bedevere-bothttps://github.com/bedevere-bot
awaiting review https://github.com/python/cpython/issues?q=state%3Aopen%20label%3A%22awaiting%20review%22
Sep 1, 2022https://github.com/python/cpython/pull/96492#event-7308772435
https://github.com/bedevere-bot
bedevere-bothttps://github.com/bedevere-bot
Sep 1, 2022https://github.com/python/cpython/pull/96492#issuecomment-1234801191
require a NEWS entryhttps://devguide.python.org/committing/#updating-news-and-what-s-new-in-python
blurb_ithttps://blurb-it.herokuapp.com
blurbhttps://pypi.org/project/blurb/
Please reload this pagehttps://github.com/python/cpython/pull/96492
https://github.com/sashashura
sashashurahttps://github.com/sashashura
Sep 1, 2022https://github.com/python/cpython/pull/96492#issuecomment-1234802788
Please reload this pagehttps://github.com/python/cpython/pull/96492
require a NEWS entryhttps://devguide.python.org/committing/#updating-news-and-what-s-new-in-python
blurb_ithttps://blurb-it.herokuapp.com
blurbhttps://pypi.org/project/blurb/
Please reload this pagehttps://github.com/python/cpython/pull/96492
https://github.com/AlexWaygood
AlexWaygoodhttps://github.com/AlexWaygood
skip news https://github.com/python/cpython/issues?q=state%3Aopen%20label%3A%22skip%20news%22
skip issue https://github.com/python/cpython/issues?q=state%3Aopen%20label%3A%22skip%20issue%22
Sep 1, 2022https://github.com/python/cpython/pull/96492#event-7308790243
https://github.com/kumaraditya303
kumaraditya303https://github.com/kumaraditya303
ambvhttps://github.com/ambv
ewdurbinhttps://github.com/ewdurbin
September 4, 2022 06:20https://github.com/python/cpython/pull/96492#event-7318016801
https://github.com/matthiasgoergens
matthiasgoergenshttps://github.com/matthiasgoergens
Sep 6, 2022https://github.com/python/cpython/pull/96492#issuecomment-1237927860
Please reload this pagehttps://github.com/python/cpython/pull/96492
https://github.com/sashashura
sashashurahttps://github.com/sashashura
Sep 6, 2022https://github.com/python/cpython/pull/96492#issuecomment-1237948101
Please reload this pagehttps://github.com/python/cpython/pull/96492
https://github.com/sashashura
sashashurahttps://github.com/sashashura
Sep 20, 2022https://github.com/python/cpython/pull/96492#issuecomment-1251937264
Please reload this pagehttps://github.com/python/cpython/pull/96492
https://github.com/sashashura
Update project-updater.ymlhttps://github.com/python/cpython/pull/96492/commits/044420ffa7f4765af5a7136004a8d3207182740a
044420fhttps://github.com/python/cpython/pull/96492/commits/044420ffa7f4765af5a7136004a8d3207182740a
https://github.com/sashashura
sashashurahttps://github.com/sashashura
Sep 22, 2022https://github.com/python/cpython/pull/96492#issuecomment-1254679804
https://user-images.githubusercontent.com/93376818/191693965-205f80a1-4113-4bbc-8d93-5a619507faf3.png
Please reload this pagehttps://github.com/python/cpython/pull/96492
https://github.com/matthiasgoergens
matthiasgoergenshttps://github.com/matthiasgoergens
Sep 23, 2022https://github.com/python/cpython/pull/96492#issuecomment-1255727870
Please reload this pagehttps://github.com/python/cpython/pull/96492
https://github.com/JelleZijlstra
JelleZijlstrahttps://github.com/JelleZijlstra
ezio-melottihttps://github.com/ezio-melotti
October 7, 2022 16:47https://github.com/python/cpython/pull/96492#event-7545113386
https://github.com/ezio-melotti
ezio-melottihttps://github.com/ezio-melotti
Oct 7, 2022https://github.com/python/cpython/pull/96492#event-7545137121
https://github.com/ezio-melotti
ezio-melottihttps://github.com/ezio-melotti
Oct 8, 2022 https://github.com/python/cpython/pull/96492#pullrequestreview-1135197330
View reviewed changes https://github.com/python/cpython/pull/96492/files/044420ffa7f4765af5a7136004a8d3207182740a
https://github.com/bedevere-bot
bedevere-bothttps://github.com/bedevere-bot
awaiting merge https://github.com/python/cpython/issues?q=state%3Aopen%20label%3A%22awaiting%20merge%22
awaiting review https://github.com/python/cpython/issues?q=state%3Aopen%20label%3A%22awaiting%20review%22
Oct 8, 2022https://github.com/python/cpython/pull/96492#event-7547666886
https://github.com/ezio-melotti
ezio-melottihttps://github.com/ezio-melotti
c66dbddhttps://github.com/python/cpython/commit/c66dbddfbaa374a6954897809574ee9fb463e393
Oct 8, 2022https://github.com/python/cpython/pull/96492#event-7547667015
https://github.com/bedevere-bot
bedevere-bothttps://github.com/bedevere-bot
awaiting merge https://github.com/python/cpython/issues?q=state%3Aopen%20label%3A%22awaiting%20merge%22
Oct 8, 2022https://github.com/python/cpython/pull/96492#event-7547667067
https://github.com/ezio-melotti
ezio-melottihttps://github.com/ezio-melotti
Oct 8, 2022https://github.com/python/cpython/pull/96492#issuecomment-1272262001
https://github.com/python/cpython/actions/runs/3209712807https://github.com/python/cpython/actions/runs/3209712807
Please reload this pagehttps://github.com/python/cpython/pull/96492
carljmhttps://github.com/carljm
Oct 8, 2022 https://github.com/python/cpython/pull/96492#ref-commit-d67d6fd
https://github.com/carljm
Merge branch 'main' into typewatchhttps://github.com/carljm/cpython/commit/d67d6fdd7aa8c0a9e90c632dfb21a228d429fe48
d67d6fdhttps://github.com/carljm/cpython/commit/d67d6fdd7aa8c0a9e90c632dfb21a228d429fe48
pythongh-68686https://github.com/python/cpython/issues/68686
python#98064https://github.com/python/cpython/pull/98064
pythongh-97922https://github.com/python/cpython/issues/97922
python#97920https://github.com/python/cpython/pull/97920
python#96492https://github.com/python/cpython/pull/96492
python#98079https://github.com/python/cpython/pull/98079
pythongh-97913https://github.com/python/cpython/issues/97913
python#97921https://github.com/python/cpython/pull/97921
python#96914https://github.com/python/cpython/pull/96914
pythongh-97822https://github.com/python/cpython/issues/97822
python#98027https://github.com/python/cpython/pull/98027
pythongh-91052https://github.com/python/cpython/issues/91052
python#98055https://github.com/python/cpython/pull/98055
pythonGH-98023https://github.com/python/cpython/issues/98023
python#98024https://github.com/python/cpython/pull/98024
pythonGH-94182https://github.com/python/cpython/issues/94182
python#94184https://github.com/python/cpython/pull/94184
carljmhttps://github.com/carljm
Oct 9, 2022 https://github.com/python/cpython/pull/96492#ref-commit-132c32e
https://github.com/carljm
Merge branch 'main' into urllibnonethttps://github.com/carljm/cpython/commit/132c32e713bb3ff5af50ddf47bb2218d8b08c6ac
132c32ehttps://github.com/carljm/cpython/commit/132c32e713bb3ff5af50ddf47bb2218d8b08c6ac
pythonGH-24901https://github.com/python/cpython/pull/24901
python#98102https://github.com/python/cpython/pull/98102
pythonGH-94597https://github.com/python/cpython/issues/94597
python#98089https://github.com/python/cpython/pull/98089
python#98009https://github.com/python/cpython/pull/98009
pythongh-95011https://github.com/python/cpython/issues/95011
pythonGH-95012https://github.com/python/cpython/pull/95012
pythongh-68686https://github.com/python/cpython/issues/68686
python#98064https://github.com/python/cpython/pull/98064
pythongh-97922https://github.com/python/cpython/issues/97922
python#97920https://github.com/python/cpython/pull/97920
python#96492https://github.com/python/cpython/pull/96492
python#98079https://github.com/python/cpython/pull/98079
pythongh-97913https://github.com/python/cpython/issues/97913
python#97921https://github.com/python/cpython/pull/97921
python#96914https://github.com/python/cpython/pull/96914
pythongh-97822https://github.com/python/cpython/issues/97822
python#98027https://github.com/python/cpython/pull/98027
pythongh-91052https://github.com/python/cpython/issues/91052
python#98055https://github.com/python/cpython/pull/98055
pythonGH-98023https://github.com/python/cpython/issues/98023
python#98024https://github.com/python/cpython/pull/98024
pythonGH-94182https://github.com/python/cpython/issues/94182
python#94184https://github.com/python/cpython/pull/94184
pythongh-92886https://github.com/python/cpython/issues/92886
pythonGH-98058https://github.com/python/cpython/pull/98058
pythongh-92886https://github.com/python/cpython/issues/92886
pythonGH-98060https://github.com/python/cpython/pull/98060
pythongh-57179https://github.com/python/cpython/issues/57179
python#94799https://github.com/python/cpython/pull/94799
pythongh-94808https://github.com/python/cpython/issues/94808
python#98036https://github.com/python/cpython/pull/98036
pythongh-90085https://github.com/python/cpython/issues/90085
python#94941https://github.com/python/cpython/pull/94941
mpagehttps://github.com/mpage
Oct 11, 2022 https://github.com/python/cpython/pull/96492#ref-commit-b31a5ee
https://github.com/sashashura
https://github.com/mpage
GitHub Workflows security hardening (https://github.com/mpage/cpython/commit/b31a5ee104059ac616958e821466ce89d03d58f8
python#96492https://github.com/python/cpython/pull/96492
)https://github.com/mpage/cpython/commit/b31a5ee104059ac616958e821466ce89d03d58f8
b31a5eehttps://github.com/mpage/cpython/commit/b31a5ee104059ac616958e821466ce89d03d58f8
Sign up for freehttps://github.com/join?source=comment-repo
Sign in to commenthttps://github.com/login?return_to=https%3A%2F%2Fgithub.com%2Fpython%2Fcpython%2Fpull%2F96492
https://github.com/ezio-melotti
ezio-melotti https://github.com/ezio-melotti
https://github.com/python/cpython/pull/96492/files/044420ffa7f4765af5a7136004a8d3207182740a
https://github.com/ambv
ambv https://github.com/ambv
https://github.com/ewdurbin
ewdurbin https://github.com/ewdurbin
https://github.com/ezio-melotti
ezio-melotti https://github.com/ezio-melotti
skip issue https://github.com/python/cpython/issues?q=state%3Aopen%20label%3A%22skip%20issue%22
skip news https://github.com/python/cpython/issues?q=state%3Aopen%20label%3A%22skip%20news%22
CPython labels https://github.com/orgs/python/projects/25
Sprint 2024 https://github.com/orgs/python/projects/32
Please reload this pagehttps://github.com/python/cpython/pull/96492
https://github.com/sashashura
https://github.com/bedevere-bot
https://github.com/matthiasgoergens
https://github.com/ezio-melotti
https://github.com/AlexWaygood
https://github.com
Termshttps://docs.github.com/site-policy/github-terms/github-terms-of-service
Privacyhttps://docs.github.com/site-policy/privacy-policies/github-privacy-statement
Securityhttps://github.com/security
Statushttps://www.githubstatus.com/
Communityhttps://github.community/
Docshttps://docs.github.com/
Contacthttps://support.github.com?tags=dotcom-footer

Viewport: width=device-width

URLs of crawlers that visited me.