Merge pull request #1 from step-security-bot/stepsecurity_remediation…

…_1718306137 [StepSecurity] ci: Harden GitHub Actions
intel · Jun 13, 2024 · 5a071fd · 5a071fd
2 parents 06e335b + bfacd65
commit 5a071fd
Show file tree

Hide file tree

Showing 34 changed files with 102 additions and 0 deletions.
diff --git a/.github/workflows/e2eaiok_deltatuner_nightly_pypi.yml b/.github/workflows/e2eaiok_deltatuner_nightly_pypi.yml
@@ -9,6 +9,9 @@ on:
       - 'e2eAIOK/deltatuner/version'
 
 
+permissions:
+  contents: read
+
 jobs:
   e2eaiok-dtuner-nightly-python-pypi:
     runs-on: ubuntu-latest

diff --git a/.github/workflows/e2eaiok_deltatuner_release_pypi.yml b/.github/workflows/e2eaiok_deltatuner_release_pypi.yml
@@ -3,6 +3,9 @@ name: Publish E2EAIOK Deltatuner Release to PyPI
 on:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   e2eaiok-dtuner-nightly-python-pypi:
     runs-on: ubuntu-latest

diff --git a/.github/workflows/integration_test_deltatuner.yml b/.github/workflows/integration_test_deltatuner.yml
@@ -10,6 +10,9 @@ on:
     - 'example/instruction_tuning_pipeline/finetune_clm.py'
     - 'tests/deltatuner/cicd/**'
 
+permissions:
+  contents: read
+
 jobs:
   integration_test:
     name: Integration Test Deltatuner

diff --git a/.github/workflows/integration_test_denas_asr.yml b/.github/workflows/integration_test_denas_asr.yml
@@ -15,6 +15,9 @@ on:
     - 'tests/cicd/test_denas.bats'
     - 'tests/cicd/jenkins_denas_asr.sh'
 
+permissions:
+  contents: read
+
 jobs:
   integration_test:
     name: Integration Test DeNas ASR

diff --git a/.github/workflows/integration_test_denas_cnn.yml b/.github/workflows/integration_test_denas_cnn.yml
@@ -15,6 +15,9 @@ on:
     - 'tests/cicd/test_denas.bats'
     - 'tests/cicd/jenkins_denas_cnn.sh'
 
+permissions:
+  contents: read
+
 jobs:
   integration_test:
     name: Integration Test DeNas CNN

diff --git a/.github/workflows/integration_test_denas_hf.yml b/.github/workflows/integration_test_denas_hf.yml
@@ -14,6 +14,9 @@ on:
     - 'tests/cicd/test_denas.bats'
     - 'tests/cicd/jenkins_denas_hf.sh'
 
+permissions:
+  contents: read
+
 jobs:
   integration_test:
     name: Integration Test DeNas HF

diff --git a/.github/workflows/integration_test_denas_nlp.yml b/.github/workflows/integration_test_denas_nlp.yml
@@ -15,6 +15,9 @@ on:
     - 'tests/cicd/test_denas.bats'
     - 'tests/cicd/jenkins_denas_bert.sh'
 
+permissions:
+  contents: read
+
 jobs:
   integration_test:
     name: Integration Test DeNas NLP

diff --git a/.github/workflows/integration_test_denas_vit.yml b/.github/workflows/integration_test_denas_vit.yml
@@ -15,6 +15,9 @@ on:
     - 'tests/cicd/test_denas.bats'
     - 'tests/cicd/jenkins_denas_vit.sh'
 
+permissions:
+  contents: read
+
 jobs:
   integration_test:
     name: Integration Test DeNas ViT

diff --git a/.github/workflows/integration_test_denas_vit_imagenet.yml b/.github/workflows/integration_test_denas_vit_imagenet.yml
@@ -15,6 +15,9 @@ on:
     - 'tests/cicd/test_denas.bats'
     - 'tests/cicd/jenkins_denas_vit_imagenet.sh'
 
+permissions:
+  contents: read
+
 jobs:
   integration_test:
     name: Integration Test DeNas ViT ImageNet

diff --git a/.github/workflows/integration_test_ma_adapter.yml b/.github/workflows/integration_test_ma_adapter.yml
@@ -12,6 +12,9 @@ on:
     - 'tests/cicd/jenkins_ma_adapter_test.sh'
     - 'modelzoo/unet/**'
 
+permissions:
+  contents: read
+
 jobs:
   integration_test:
     name: Integration Test Model Adapter domain adapter

diff --git a/.github/workflows/integration_test_ma_baseline_ddp.yml b/.github/workflows/integration_test_ma_baseline_ddp.yml
@@ -13,6 +13,9 @@ on:
     - 'tests/cicd/ModelAdapterJenkinsfile'
     - 'tests/cicd/jenkins_ma_baseline_ddp_test.sh'
 
+permissions:
+  contents: read
+
 jobs:
   integration_test:
     name: Integration Test Model Adapter baseline DDP

diff --git a/.github/workflows/integration_test_ma_distiller.yml b/.github/workflows/integration_test_ma_distiller.yml
@@ -13,6 +13,9 @@ on:
     - 'tests/cicd/ModelAdapterJenkinsfile'
     - 'tests/cicd/jenkins_ma_distiller_test.sh'
 
+permissions:
+  contents: read
+
 jobs:
   integration_test:
     name: Integration Test Model Adapter distiller

diff --git a/.github/workflows/integration_test_ma_finetuner.yml b/.github/workflows/integration_test_ma_finetuner.yml
@@ -13,6 +13,9 @@ on:
     - 'tests/cicd/ModelAdapterJenkinsfile'
     - 'tests/cicd/jenkins_ma_finetuner_test.sh'
 
+permissions:
+  contents: read
+
 jobs:
   integration_test:
     name: Integration Test Model Adapter finetuner

diff --git a/.github/workflows/integration_test_workflow_nlp.yml b/.github/workflows/integration_test_workflow_nlp.yml
@@ -15,6 +15,9 @@ on:
     - 'tests/cicd/test_denas.bats'
     - 'tests/cicd/jenkins_workflow_bert.sh'
 
+permissions:
+  contents: read
+
 jobs:
   integration_test:
     name: Integration Test Workflow NLP

diff --git a/.github/workflows/integration_test_workload_bert.yml b/.github/workflows/integration_test_workload_bert.yml
@@ -20,6 +20,9 @@ on:
     - 'tests/cicd/Jenkinsfile*'
     - 'tests/cicd/jenkins_bert_test*.sh'
 
+permissions:
+  contents: read
+
 jobs:
   integration_test:
     name: Integration Test Workload BERT

diff --git a/.github/workflows/integration_test_workload_dien.yml b/.github/workflows/integration_test_workload_dien.yml
@@ -20,6 +20,9 @@ on:
     - 'tests/cicd/Jenkinsfile*'
     - 'tests/cicd/jenkins_dien_test*.sh'
 
+permissions:
+  contents: read
+
 jobs:
   integration_test:
     name: Integration Test Workload DIEN

diff --git a/.github/workflows/integration_test_workload_dlrm.yml b/.github/workflows/integration_test_workload_dlrm.yml
@@ -20,6 +20,9 @@ on:
     - 'tests/cicd/Jenkinsfile*'
     - 'tests/cicd/jenkins_dlrm_test*.sh'
 
+permissions:
+  contents: read
+
 jobs:
   integration_test:
     name: Integration Test Workload DLRM

diff --git a/.github/workflows/integration_test_workload_minigo.yml b/.github/workflows/integration_test_workload_minigo.yml
@@ -19,6 +19,9 @@ on:
     - 'tests/cicd/Jenkinsfile*'
     - 'tests/cicd/jenkins_minigo_test*.sh'
 
+permissions:
+  contents: read
+
 jobs:
   integration_test:
     name: Integration Test Workload MiniGo

diff --git a/.github/workflows/integration_test_workload_pipeline.yml b/.github/workflows/integration_test_workload_pipeline.yml
@@ -21,6 +21,9 @@ on:
     - 'tests/cicd/docker_horovod_test.sh'
     - 'tests/cicd/docker_torchccl_test'
 
+permissions:
+  contents: read
+
 jobs:
   integration_test:
     name: Integration Test Workload Basic Pipeline

diff --git a/.github/workflows/integration_test_workload_resnet.yml b/.github/workflows/integration_test_workload_resnet.yml
@@ -20,6 +20,9 @@ on:
     - 'tests/cicd/Jenkinsfile*'
     - 'tests/cicd/jenkins_resnet_test*.sh'
 
+permissions:
+  contents: read
+
 jobs:
   integration_test:
     name: Integration Test Workload ResNet

diff --git a/.github/workflows/integration_test_workload_rnnt.yml b/.github/workflows/integration_test_workload_rnnt.yml
@@ -20,6 +20,9 @@ on:
     - 'tests/cicd/Jenkinsfile*'
     - 'tests/cicd/jenkins_rnnt_test*.sh'
 
+permissions:
+  contents: read
+
 jobs:
   integration_test:
     name: Integration Test Workload RNNT

diff --git a/.github/workflows/integration_test_workload_wnd.yml b/.github/workflows/integration_test_workload_wnd.yml
@@ -20,6 +20,9 @@ on:
     - 'tests/cicd/Jenkinsfile*'
     - 'tests/cicd/jenkins_wnd_test*.sh'
 
+permissions:
+  contents: read
+
 jobs:
   integration_test:
     name: Integration Test Workload WnD

diff --git a/.github/workflows/performance_test.yml b/.github/workflows/performance_test.yml
@@ -6,6 +6,9 @@ on:
     branches:
     - RecDP_v2.0
 
+permissions:
+  contents: read
+
 jobs:
   perf-test:
     name: Performance test AutoFE

diff --git a/.github/workflows/release_docker_e2eaiokv12.yml b/.github/workflows/release_docker_e2eaiokv12.yml
@@ -13,6 +13,9 @@ on:
       - 'Dockerfile-ubuntu/Dockerfile-v1.2'
       - '.github/workflows/release_docker_e2eaiokv12.yml'
 
+permissions:
+  contents: read
+
 jobs:
   e2eaiok-release-docker:
     runs-on: self-hosted

diff --git a/.github/workflows/release_docker_pytorch.yml b/.github/workflows/release_docker_pytorch.yml
@@ -13,6 +13,9 @@ on:
       - 'Dockerfile-ubuntu/DockerfilePytorch'
       - '.github/workflows/release_docker_pytorch.yml'
 
+permissions:
+  contents: read
+
 jobs:
   e2eaiok-release-docker:
     runs-on: self-hosted

diff --git a/.github/workflows/release_docker_pytorch112.yml b/.github/workflows/release_docker_pytorch112.yml
@@ -13,6 +13,9 @@ on:
       - 'Dockerfile-ubuntu/DockerfilePytorch112'
       - '.github/workflows/release_docker_pytorch112.yml'
 
+permissions:
+  contents: read
+
 jobs:
   e2eaiok-release-docker:
     runs-on: self-hosted

diff --git a/.github/workflows/release_docker_tensorflow.yml b/.github/workflows/release_docker_tensorflow.yml
@@ -13,6 +13,9 @@ on:
       - 'Dockerfile-ubuntu/DockerfileTensorflow'
       - '.github/workflows/release_docker_tensorflow.yml'
 
+permissions:
+  contents: read
+
 jobs:
   e2eaiok-release-docker:
     runs-on: self-hosted

diff --git a/.github/workflows/unittest_autofe.yml b/.github/workflows/unittest_autofe.yml
@@ -13,6 +13,9 @@ on:
     - 'RecDP/tests/cicd/bashrun_unittest_autofe.sh'
     - 'RecDP/tests/test_autofe.py'
 
+permissions:
+  contents: read
+
 jobs:
   unittest:
     name: Unittest AutoFE

diff --git a/.github/workflows/unittest_denas.yml b/.github/workflows/unittest_denas.yml
@@ -14,6 +14,9 @@ on:
     - 'tests/unittest/denas/**'
     - 'setup.py'
 
+permissions:
+  contents: read
+
 jobs:
   unit_tests:
     name: Unit Test DENAS

diff --git a/.github/workflows/unittest_llmutils.yml b/.github/workflows/unittest_llmutils.yml
@@ -8,6 +8,9 @@ on:
     - 'RecDP/tests/cicd/bashrun_unittest_llmutils.sh'
     - 'RecDP/tests/test_llmutils.py'
 
+permissions:
+  contents: read
+
 jobs:
   unittest:
     name: Unittest LLMUtils

diff --git a/.github/workflows/unittest_llmutils_operations.yml b/.github/workflows/unittest_llmutils_operations.yml
@@ -9,6 +9,9 @@ on:
     - 'RecDP/tests/cicd/bashrun_unittest_llmutilspipeline.sh'
     - 'RecDP/tests/test_llmutils_operations.py'
 
+permissions:
+  contents: read
+
 jobs:
   unittest:
     name: Unittest LLM Operations

diff --git a/.github/workflows/unittest_llmutils_pipeline.yml b/.github/workflows/unittest_llmutils_pipeline.yml
@@ -9,6 +9,9 @@ on:
     - 'RecDP/tests/cicd/bashrun_unittest_llmutilspipeline.sh'
     - 'RecDP/tests/test_llmutils_operations.py'
 
+permissions:
+  contents: read
+
 jobs:
   unittest:
     name: Unittest LLM Pipeline

diff --git a/.github/workflows/unittest_ma.yml b/.github/workflows/unittest_ma.yml
@@ -15,6 +15,9 @@ on:
     - 'tests/unittest/ma/**'
     - 'setup.py'
 
+permissions:
+  contents: read
+
 jobs:
   unit_tests:
     name: Unit Test MA

diff --git a/.github/workflows/unittest_util.yml b/.github/workflows/unittest_util.yml
@@ -11,6 +11,9 @@ on:
     - 'tests/unittest/utils/**'
     - 'setup.py'
 
+permissions:
+  contents: read
+
 jobs:
   unit_tests:
     name: Unit Test Util