From c60e5019091967609f3fb95563f0c413e04d597c Mon Sep 17 00:00:00 2001 From: Marc Fehling Date: Tue, 10 May 2022 11:15:15 -0600 Subject: [PATCH] Restrict permissions for GITHUB_TOKEN. --- .github/workflows/docker.yml | 4 ++++ .github/workflows/indent.yml | 3 +++ .github/workflows/linux.yml | 3 +++ .github/workflows/osx.yml | 3 +++ .github/workflows/windows.yml | 3 +++ 5 files changed, 16 insertions(+) diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml index ca87f319f7..853d90890a 100644 --- a/.github/workflows/docker.yml +++ b/.github/workflows/docker.yml @@ -4,6 +4,10 @@ on: push: branches: [master] +permissions: + contents: read + packages: write + jobs: build-master-docker: runs-on: ubuntu-latest diff --git a/.github/workflows/indent.yml b/.github/workflows/indent.yml index eae7be5a0f..e7474201cc 100644 --- a/.github/workflows/indent.yml +++ b/.github/workflows/indent.yml @@ -6,6 +6,9 @@ concurrency: group: ${ {github.event_name }}-${{ github.workflow }}-${{ github.ref }} cancel-in-progress: ${{github.event_name == 'pull_request'}} +permissions: + contents: read + jobs: indent: # run the indent checks diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml index 38d72c4aea..b73ee3ad60 100644 --- a/.github/workflows/linux.yml +++ b/.github/workflows/linux.yml @@ -6,6 +6,9 @@ concurrency: group: ${ {github.event_name }}-${{ github.workflow }}-${{ github.ref }} cancel-in-progress: ${{github.event_name == 'pull_request'}} +permissions: + contents: read + jobs: linux-release-serial: # simple serial release build using g++ diff --git a/.github/workflows/osx.yml b/.github/workflows/osx.yml index fce0866b32..17518d8a6d 100644 --- a/.github/workflows/osx.yml +++ b/.github/workflows/osx.yml @@ -6,6 +6,9 @@ concurrency: group: ${ {github.event_name }}-${{ github.workflow }}-${{ github.ref }} cancel-in-progress: ${{github.event_name == 'pull_request'}} +permissions: + contents: read + jobs: osx-serial: # simple serial build using apple clang diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml index b46066f105..8c09e66cd2 100644 --- a/.github/workflows/windows.yml +++ b/.github/workflows/windows.yml @@ -6,6 +6,9 @@ concurrency: group: ${ {github.event_name }}-${{ github.workflow }}-${{ github.ref }} cancel-in-progress: ${{github.event_name == 'pull_request'}} +permissions: + contents: read + jobs: windows-serial: # Serial build on Windows -- 2.39.5