I’ve released a new version of the GitHub Actions Permissions monitor. Say goodbye to the annoying “certificate validation” errors of the previous version! Quick info on how it works and what’s new.

The monitor action (https://gh.io/actions-permissions) installs a local @mitmproxy in the actions runner. During a regular run the proxy intercepts outgoing requests looking for the GITHUB_TOKEN and maps the requests to the permissions required to these operations.

This allows you to identify the actually used permissions from multiple runs and restrict your GitHub actions usage to the minimal required permissions.

In order to intercept the traffic, the monitor uses a self signed certificate. Some programs use their own certificate stores and don't recognize the certificate, causing “certificate validation” errors. I was fixing it case by case, but it reminded me of a whack-a-mole game.

The new version uses the `allow_host` feature of @mitmproxy to inject only the requests to GitHub. Actions usually use Curl, JavaScript or GitHub CLI to call GitHub API. These scenarios work well with the custom certificate.

So the permissions monitor is more precise and reliable now, intercepting only GitHub API requests to help you set your permissions correctly. Please give it a try to make your workflows more secure!