From ca0207a29e002596cd5b1ecfd935cdc9da67fde5 Mon Sep 17 00:00:00 2001 From: Alex Date: Mon, 19 Sep 2022 18:47:52 +0200 Subject: [PATCH 1/2] build: harden GitHub Workflow permissions Signed-off-by: Alex Low --- .github/workflows/ci.yml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 1e3c54674c48..0d47090d6344 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -23,6 +23,9 @@ defaults: # 3) Run the steps that depend on the build # +permissions: + contents: read # to fetch code (actions/checkout) + jobs: install: name: Checkout and Install @@ -170,6 +173,10 @@ jobs: retention-days: 1 website_tests: + permissions: + contents: read # to fetch code (actions/checkout) + actions: read # to correctly identify workflow run (cypress-io/github-action) + name: Website tests needs: [build] runs-on: ubuntu-latest From 9d17dbfd0f8d13685ac8059261eb6043c2ca8b45 Mon Sep 17 00:00:00 2001 From: Alex Date: Mon, 19 Sep 2022 18:48:15 +0200 Subject: [PATCH 2/2] build: harden GitHub Workflow permissions Signed-off-by: Alex Low --- .github/workflows/lock.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.github/workflows/lock.yml b/.github/workflows/lock.yml index 4b73d71b7a02..fc8cea8a8ac1 100644 --- a/.github/workflows/lock.yml +++ b/.github/workflows/lock.yml @@ -4,8 +4,14 @@ on: schedule: - cron: '0 0 * * *' +permissions: {} + jobs: lock: + permissions: + issues: write # to lock issues (dessant/lock-threads) + pull-requests: write # to lock PRs (dessant/lock-threads) + runs-on: ubuntu-latest steps: - uses: dessant/lock-threads@v3