Skip to content

Commit e96d9d3

Browse files
committed
CI: remove unused "permissions: packages: write"
The option "permissions: packages: write" was used to enable NuGet repository for vcpkg caching, but eventually this caching method was not used due to my security concerns of cache poisoning. It's unclear whether a third-party contributor can write arbitrary packages to the NuGet repository. Thus, regular GitHub file caching via "actions/cache" was used (which is isolated per branch, by default, it's not possible to overwrite the trusted "master" branch caching just by opening a PR). Remove unused "permissions: packages: write". Signed-off-by: Yifeng Li <tomli@tomli.me>
1 parent 2db2f8b commit e96d9d3

1 file changed

Lines changed: 0 additions & 4 deletions

File tree

.github/workflows/ci.yml

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -815,10 +815,6 @@ jobs:
815815
VCPKG_ASSET_CACHE_PATH: "${{ github.workspace }}/vcpkg-cache/asset"
816816
X_VCPKG_ASSET_SOURCES: "x-azurl,file://${{ github.workspace }}/vcpkg-cache/asset,readwrite"
817817

818-
# allow this job to create and modify vcpkg packages for binary cache
819-
permissions:
820-
packages: write
821-
822818
name: "Windows (${{ matrix.toolchain.name }}, latest)"
823819

824820
steps:

0 commit comments

Comments
 (0)