ci: set minimal permisisons on github workflows

Signed-off-by: Diogo Teles Sant'Anna <diogoteles@google.com>
AcademySoftwareFoundation · May 17, 2023 · 09517e7 · 09517e7
1 parent 2e4c522
commit 09517e7
Show file tree

Hide file tree

Showing 4 changed files with 11 additions and 0 deletions.
diff --git a/.github/workflows/analysis_workflow.yml b/.github/workflows/analysis_workflow.yml
@@ -12,6 +12,9 @@ on:
     - cron: "0 0 * * 0"
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
 
   # ---------------------------------------------------------------------------

diff --git a/.github/workflows/bazel_build.yml b/.github/workflows/bazel_build.yml
@@ -26,6 +26,9 @@ on:
     paths-ignore:
       - '**.md'
 
+permissions:
+  contents: read
+
 jobs:
   build_and_test_ubuntu:
     name: Linux Ubuntu 20.04 Bazel build <GCC 9.3.0>

diff --git a/.github/workflows/ci_workflow.yml b/.github/workflows/ci_workflow.yml
@@ -26,6 +26,9 @@ on:
     paths-ignore:
       - '**.md'
 
+permissions:
+  contents: read
+
 jobs:
   # Linux jobs run in Docker containers, so the latest OS version is OK. macOS 
   # and Windows jobs need to be locked to specific virtual environment 

diff --git a/.github/workflows/cifuzz.yml b/.github/workflows/cifuzz.yml
@@ -1,5 +1,7 @@
 name: CIFuzz
 on: [pull_request]
+permissions:
+  contents: read
 jobs:
   Fuzzing:
     runs-on: ubuntu-latest