Workflow updates #81
Workflow updates #81
Conversation
* record_type_info and load_record_types functions added * Moved functions to cli commands * Corrected review changes
…ands and YubiKey fix
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| name: Publish Keeper CLI to PyPi | ||
| runs-on: ubuntu-latest | ||
| needs: [build-n-publish] | ||
| environment: prod | ||
|
|
||
| steps: | ||
| - uses: actions/download-artifact@v3 | ||
| with: | ||
| name: CommanderWheel | ||
| path: dist | ||
| name: KeeperCLIWheel | ||
| path: keepercli-package/dist | ||
|
|
||
| - name: Set up Python 3.10 | ||
| - name: Set up Python 3.11 | ||
| uses: actions/setup-python@v4 | ||
| with: | ||
| python-version: '3.10' | ||
| architecture: 'x64' | ||
|
|
||
| - name: Retrieve secrets from Keeper | ||
| id: ksecrets | ||
| uses: Keeper-Security/ksm-action@master | ||
| with: | ||
| keeper-secret-config: ${{ secrets.KSM_COMMANDER_SECRET_CONFIG }} | ||
| secrets: | | ||
| gD5LOOhI5QbnSFk8mIg3gg/field/password > PYPI_PASSWORD | ||
| python-version: '3.11' | ||
|
|
||
| - name: Publish to PyPi | ||
| - name: Publish keepercli to PyPi | ||
| env: | ||
| TWINE_USERNAME: __token__ | ||
| TWINE_PASSWORD: ${{ steps.ksecrets.outputs.PYPI_PASSWORD }} | ||
| TWINE_PASSWORD: ${{ secrets.PYPI_PUBLISH_TOKEN }} | ||
| run: | | ||
| python -m pip install -U setuptools pip wheel twine | ||
| twine upload dist/* | ||
| twine upload -r pypi keepercli-package/dist/* |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 2 months ago
To resolve the issue, add a permissions block to the publish-pypi job. This should grant only the minimal needed permission. In this case, there is no obvious use of the GITHUB_TOKEN for write access within the publish-pypi job—there is no usage of actions that modify repository contents, releases, issues, etc. Therefore, contents: read is sufficient and aligns with least privilege. The change is to insert the following at the same indentation as other job keys under publish-pypi:
permissions:
contents: readNo other code or configuration changes are necessary. No imports or external dependencies are required.
| @@ -47,6 +47,8 @@ | ||
|
|
||
| publish-pypi: | ||
| name: Publish Keeper CLI to PyPi | ||
| permissions: | ||
| contents: read | ||
| runs-on: ubuntu-latest | ||
| needs: [build-n-publish] | ||
| environment: prod |
| name: Publish to Production PyPI | ||
| runs-on: ubuntu-latest | ||
| needs: [build-wheel] | ||
| needs: [publish-test-pypi] | ||
| environment: prod | ||
|
|
||
| steps: | ||
| - uses: actions/download-artifact@v3 | ||
| - uses: actions/download-artifact@v4 | ||
| with: | ||
| name: CommanderWheel | ||
| path: dist | ||
|
|
||
| - name: Set up Python 3.10 | ||
| uses: actions/setup-python@v4 | ||
| with: | ||
| python-version: '3.11' | ||
| name: KeeperSdkWheel | ||
| path: keepersdk-package/dist | ||
|
|
||
| - name: Retrieve secrets from Keeper | ||
| id: ksecrets | ||
| uses: Keeper-Security/ksm-action@master | ||
| - name: Set up Python 3.13 | ||
| uses: actions/setup-python@v5 | ||
| with: | ||
| keeper-secret-config: ${{ secrets.KSM_COMMANDER_SECRET_CONFIG }} | ||
| secrets: | | ||
| gD5LOOhI5QbnSFk8mIg3gg/field/password > PYPI_PASSWORD | ||
| python-version: '3.13' | ||
|
|
||
| - name: Publish to PyPi | ||
| - name: Publish to PyPI | ||
| env: | ||
| TWINE_USERNAME: __token__ | ||
| TWINE_PASSWORD: ${{ steps.ksecrets.outputs.PYPI_PASSWORD }} | ||
| TWINE_PASSWORD: ${{ secrets.PYPI_PUBLISH_TOKEN }} | ||
| run: | | ||
| python -m pip install -U setuptools pip wheel twine | ||
| twine upload dist/* | ||
| python -m pip install -U twine | ||
| twine upload keepersdk-package/dist/* |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 2 months ago
To fix this problem, add a permissions block to the publish-pypi job to explicitly restrict GITHUB_TOKEN permissions. The minimal secure baseline is permissions: contents: read, as this allows the job to read repository contents if needed, but not to perform any write actions. This change should be made inside the publish-pypi job definition, after its runs-on, needs, and environment fields (as is seen in the build-and-test job above). No imports, new dependencies, or further modifications are required in this YAML workflow.
| @@ -69,6 +69,8 @@ | ||
| runs-on: ubuntu-latest | ||
| needs: [publish-test-pypi] | ||
| environment: prod | ||
| permissions: | ||
| contents: read | ||
|
|
||
| steps: | ||
| - uses: actions/download-artifact@v4 |
examples/secrets_manager_app/secrets_manager_app_add_record.py
Dismissed
Show dismissed
Hide dismissed
examples/secrets_manager_app/secrets_manager_app_remove_record.py
Dismissed
Show dismissed
Hide dismissed
keepercli-package/src/keepercli/commands/enterprise_create_user.py
Dismissed
Show dismissed
Hide dismissed
keepercli-package/src/keepercli/commands/enterprise_create_user.py
Dismissed
Show dismissed
Hide dismissed
sk-keeper
force-pushed
the
workflow-updates
branch
2 times, most recently
from
f14f2e0 to
c475b6d
Compare
sk-keeper
force-pushed
the
workflow-updates
branch
from
db72af5 to
630250c
Compare
No description provided.