Add the GitHubSecurityLab/actions-permissions/monitor Action

[mcdonnnj]

🗣 Description

This pull request adds the GitHubSecurityLab/actions-permissions/monitor Action to the GitHub Actions workflows.

Note

I have added an organization variable called ACTIONS_PERMISSIONS_CONFIG to provide a default configuration across the organization. Repositories can change this as needed for their own purposes. The default configuration as of this pull request is:

{
    "create_artifact": true,
    "debug": false,
    "enabled": true
}

💭 Motivation and context

We have upcoming changes to the default permissions for GITHUB_TOKEN in our organization per the discussion. This Action will help repository maintainers determine the privileges necessary for their GitHub Actions configurations.

Note

Once the GitHubSecurityLab/actions-permissions/monitor Action is deployed and generating artifacts you can use the GitHubSecurityLab/actions-permissions/advisor Action either in your GitHub Actions configuration or directly on the command line (see the directions in the Action's README). This will allow you to compare permissions across multiple successful workflow runs to generate aggregate suggested permissions.

🧪 Testing

Automated tests pass. I verified the Action is running successfully by checking the run logs.

✅ Pre-approval checklist

• This PR has an informative and human-readable title.
• Changes are limited to a single goal - eschew scope creep!
• All relevant type-of-change labels have been added.
• I have read the CONTRIBUTING document.
• These code changes follow cisagov code standards.
• All new and existing tests pass.

[dav3r]

Good idea! 👍

[felddy]

Looks good. Way to take the initiative. 💪

I'm glad it isn't conflicting with the step-security/harden-runner which also proxies the API. I like this because it is more "in your face". The harden-runner is more subtle. Scroll to bottom of the runner's recommendations for this PR to see:

• https://app.stepsecurity.io/github/cisagov/skeleton-generic/actions/runs/11563574690?jobid=32187188040&tab=recommendations

I thought the harden-runner used to be louder about its recommendations. Maybe this has moved behind the commercial license?

• https://github.com/step-security/harden-runner?tab=readme-ov-file#determine-minimum-github_token-permissions-using-harden-runner