Restrict permissions for GITHUB_TOKEN.

diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index ca87f319f795025ba7d7779d2e224f8926b78069..853d90890a927d8113ae1a4b827ec70752300133 100644 (file)
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -4,6 +4,10 @@ on:
   push: 
     branches: [master]
 
+permissions:
+  contents: read
+  packages: write
+
 jobs:
   build-master-docker:
     runs-on: ubuntu-latest

diff --git a/.github/workflows/indent.yml b/.github/workflows/indent.yml
index eae7be5a0f9a33e083f99757dc7780b0a57076c3..e7474201cc93f4d9f996b4bcd73e9b05e88538ef 100644 (file)
--- a/.github/workflows/indent.yml
+++ b/.github/workflows/indent.yml
@@ -6,6 +6,9 @@ concurrency:
   group: ${ {github.event_name }}-${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: ${{github.event_name == 'pull_request'}}
 
+permissions:
+  contents: read
+
 jobs:
   indent:
     # run the indent checks

diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml
index 38d72c4aeaa48328ee905f6fd7eb7e0b9f44a32d..b73ee3ad6034e78edf063f5f36f8ad3856d69ff5 100644 (file)
--- a/.github/workflows/linux.yml
+++ b/.github/workflows/linux.yml
@@ -6,6 +6,9 @@ concurrency:
   group: ${ {github.event_name }}-${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: ${{github.event_name == 'pull_request'}}
 
+permissions:
+  contents: read
+
 jobs:
   linux-release-serial:
     # simple serial release build using g++

diff --git a/.github/workflows/osx.yml b/.github/workflows/osx.yml
index fce0866b32a2c92d449a54cb83fdd25ce32803de..17518d8a6d7a74cab58c88f0f975633c9bb38f3e 100644 (file)
--- a/.github/workflows/osx.yml
+++ b/.github/workflows/osx.yml
@@ -6,6 +6,9 @@ concurrency:
   group: ${ {github.event_name }}-${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: ${{github.event_name == 'pull_request'}}
 
+permissions:
+  contents: read
+
 jobs:
   osx-serial:
     # simple serial build using apple clang

diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml
index b46066f10563f5d64fe5641488e698b929e6d5f0..8c09e66cd2891fdd1092790665c0f6a4ee5f514b 100644 (file)
--- a/.github/workflows/windows.yml
+++ b/.github/workflows/windows.yml
@@ -6,6 +6,9 @@ concurrency:
   group: ${ {github.event_name }}-${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: ${{github.event_name == 'pull_request'}}
 
+permissions:
+  contents: read
+
 jobs:
   windows-serial:
     # Serial build on Windows