[meta] GH: default token permissions?

[geekosaur]

(from https://github.com/haskell/cabal/pull/10331/files#r1748758142 ff.)

I should note that, if the default token does in fact have permissions to make releases, what other permissions does it have that might be problematic with respect to random composite actions? Does someone need to audit the actions we use regularly to make sure they're safe? The actual (as opposed to documented) permissions structure seems to lean a bit too far toward convenience over security.

(Background: GitHub Actions documentation claims that "actions" (formally "composite actions" per GHA docs) don't have access to the workflow's token, but it appears that in fact they do. (In fact, I just read through it again, and it's talking about secrets, which are a different feature that we don't use and don't include the workflow's tokens. Which leaves open the question of token security.) The default token also apparently has sufficient permissions to make releases, again contrary to documentation including the documentation for the auto-release action we are using, which asserts that we need to grant the workflow token permissions: write. From a security standpoint, this is worrisome.)

[geekosaur]

It turns out that the default token in fact didn't have permissions, so that's one question answered. (I had understood that the default token permission was read, not write.)

[geekosaur]

https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/accessing-contextual-information-about-workflow-runs#secrets-context claims that GITHUB_TOKEN is a secret. So why is it available to actions?

ETA: because it's in ${{ github.token }}, apparently

[geekosaur]

Welp. Seems someone's been using this to steal access tokens, and while the article mentions only one affected composite action, it's since been found to have infected a lot more widely-used actions.