ci: add minimal permissions on github workflows (#258)

Signed-off-by: Diogo Teles Sant'Anna <diogoteles@google.com>
mojohaus · Sep 2, 2023 · 6e6d11d · 6e6d11d
1 parent 84ec7af
commit 6e6d11d
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 0 deletions.
diff --git a/.github/workflows/maven.yml b/.github/workflows/maven.yml
@@ -21,6 +21,9 @@ name: GitHub CI
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Verify

diff --git a/.github/workflows/release-drafter.yml b/.github/workflows/release-drafter.yml
@@ -3,10 +3,17 @@ on:
   push:
     branches:
       - master
+
+permissions:
+  contents: read
+
 jobs:
   update_release_draft:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write  # for release-drafter/release-drafter to create a github release
     steps:
       - uses: release-drafter/release-drafter@v5
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+