Discussion on how to prevent the leakage of repository secrets.

[yanguoyu]

Recently, due to the malicious execution of workflows in the Neuron repository, repository secrets may have been leaked.

There are some issues that we need to discuss.

1. Is signing required for the test package?
2. How about skipping packaging when triggered by a comment but the user is not a member of the repo?

Are there any alternative solutions that can better prevent secrets from being leaked?

[yanguoyu]

To minimize secret usage, we will only use secrets on the master and RC branches. And we will set the package_for_test workflow and add permission for the GITHUB_TOKEN.

Here is the permission doc: https://docs.github.com/zh/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idpermissions

I will set the permission like this:

jobs:
  packaging:
      permissions:
        contents: read
      ...
  comment_when_package_success:
    permissions:
      pull-requests: write
      // contents write permission for write comment for commit
      contents: write 
      ...
  comment_when_package_failed:
    permissions:
      pull-requests: write
      ...

[yanguoyu]

To minimize packaging permission, I will also judge whether the PR comment creator is the current repo's owner or member.