# Copyright 2024 OpenSSF Scorecard Authors
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

id: topLevelPermissions
lifecycle: experimental
short: Checks that the project does not have any top-level write permissions in its workflows.
motivation: >
  In some circumstances, having "write" permissions at the "top" level may enable attackers to escalate privileges.
implementation: >
  The probe checks the permission level, the workflow type and the permission type of each workflow in the project.
outcome:
  - The probe returns 1 false outcome per workflow with "write" permissions at the "top" level.
  - The probe returns 1 true outcome if the project has no workflows "write" permissions a the "top" level.
remediation:
  onOutcome: False
  effort: Low
  text:
    - Visit https://app.stepsecurity.io/secureworkflow/${{ metadata.repository.uri }}/${{ metadata.workflow }}/${{ metadata.repository.defaultBranch }}?enable=permissions
    - Tick the 'Restrict permissions for GITHUB_TOKEN'
    - Untick other options
    - "NOTE: If you want to resolve multiple issues at once, you can visit https://app.stepsecurity.io/securerepo instead."
  markdown:
    - Visit [https://app.stepsecurity.io/secureworkflow](https://app.stepsecurity.io/secureworkflow/${{ metadata.repository.uri }}/${{ metadata.workflow }}/${{ metadata.repository.defaultBranch }}?enable=permissions).
    - Tick the 'Restrict permissions for GITHUB_TOKEN'
    - Untick other options
    - "NOTE: If you want to resolve multiple issues at once, you can visit [https://app.stepsecurity.io/securerepo](https://app.stepsecurity.io/securerepo) instead."