protobuf

15753 Commits

198 Branches

349 Tags

255 MiB

Tag: Branch: Tree: d7abdcffbe

Commit Graph

Author SHA1 Message Date

Author	SHA1	Message	Date
Joyce	010fde9a18	Set top level permissions to read only on GitHub Workflows (#12971 ) Hi, here is Joyce from Google again. I'd like starting suggesting the [Token-Permission check](https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions) fix. Let me know if I might be missing any permission. Thanks! ### Security Reason This is needed because, by default, github grants write-all permission to all workflows, which could be exploit by an attacker in case of a compromised workflow. Limiting permissions is a simple and effective way to also limit the impact of an eventual compromised workflow. Thus, it is both a recommendation from [OpenSSF Scorecard](https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions) and the [Github](https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions) to always use credentials that are minimally scoped. Closes #12971 COPYBARA_INTEGRATE_REVIEW=https://github.com/protocolbuffers/protobuf/pull/12971 from joycebrum:main `6d6dac5678` PiperOrigin-RevId: 537973051	2 years ago
Mike Kruskal	0e48352e6d	Expand lifetime of repository cache. These are not growing fast at all, but are taking a long time to asymptotically fill out. PiperOrigin-RevId: 512086597	2 years ago
Mike Kruskal	0ed65fd08f	Enable github caching of Bazel's repository cache. This should substantially reduce network flakes, since most builds will no longer need to download external dependencies. Because these caches actually get pretty expensive (~300 MB just from 1 openjdk dependency), we've taken some precautions: 1) The caches only get updated on push events (i.e. post-submit jobs) 2) Only a single job will push a new cache for any os/branch/commit combination. This will be whichever job finishes its bazel run first, and also has updates for the cache. Over time, the cache should expand to the full set of transitive dependencies as the quicker jobs stop pushing updates. 3) A clear_caches workflow has been introduced to reset the caches in case they grow too large. This will run monthly for now, but can also be run manually. PiperOrigin-RevId: 508133044	2 years ago

Joyce

010fde9a18

Set top level permissions to read only on GitHub Workflows (#12971 )

Hi, here is Joyce from Google again.

I'd like starting suggesting the [Token-Permission check](https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions) fix.

Let me know if I might be missing any permission. Thanks!

### Security Reason

This is needed because, by default, github grants write-all permission to all workflows, which could be exploit by an attacker in case of a compromised workflow. Limiting permissions is a simple and effective way to also limit the impact of an eventual compromised workflow.

Thus, it is both a recommendation from [OpenSSF Scorecard](https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions) and the [Github](https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions) to always use credentials that are minimally scoped.

Closes #12971

COPYBARA_INTEGRATE_REVIEW=https://github.com/protocolbuffers/protobuf/pull/12971 from joycebrum:main 6d6dac5678
PiperOrigin-RevId: 537973051

2 years ago

Mike Kruskal

0e48352e6d

Expand lifetime of repository cache.

These are not growing fast at all, but are taking a long time to asymptotically fill out.

PiperOrigin-RevId: 512086597

2 years ago

Mike Kruskal

0ed65fd08f

Enable github caching of Bazel's repository cache.

This should substantially reduce network flakes, since most builds will no longer need to download external dependencies.  Because these caches actually get pretty expensive (~300 MB just from 1 openjdk dependency), we've taken some precautions:

1) The caches only get updated on push events (i.e. post-submit jobs)
2) Only a single job will push a new cache for any os/branch/commit combination.  This will be whichever job finishes its bazel run first, and *also* has updates for the cache.  Over time, the cache should expand to the full set of transitive dependencies as the quicker jobs stop pushing updates.
3) A clear_caches workflow has been introduced to reset the caches in case they grow too large.  This will run monthly for now, but can also be run manually.

PiperOrigin-RevId: 508133044

2 years ago

3 Commits (d7abdcffbee52c6cf71d872d3859505011135536)