`065f5ffc5ae107f752b908d1c81e4c4f3e26e7b7`

Author: Alex <aleksandrosansan@gmail.com>
Committer: GitHub <noreply@github.com>
Date: 2022-10-07 12:39 UTC

Message

ci: harden permissions for GitHub Workflows (#11174)

* build: harden main.yml permissions
Signed-off-by: Alex <aleksandrosansan@gmail.com>

* build: harden project.yml permissions
Signed-off-by: Alex <aleksandrosansan@gmail.com>

* Update project.yml

The permissions are not necessary, because a separate token is used `GITHUB_TOKEN: ${{ secrets.PROJECT_TOKEN }}`

Diff

 1diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
 2index 50e00f9c9855c7aadf3a12efe717d48c2dd86298..57a1e38337d385e217b2c6c803f2ade7aa1874ff 100644
 3--- a/.github/workflows/main.yml
 4+++ b/.github/workflows/main.yml
 5@@ -14,6 +14,9 @@ concurrency:
 6   group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
 7   cancel-in-progress: true
 8 
 9+permissions:
10+  contents: read # to fetch code (actions/checkout)
11+
12 jobs:
13   tests:
14     name: Run tests
15diff --git a/.github/workflows/project.yml b/.github/workflows/project.yml
16index b2219893d9bcd1a99d4b7013887182ccf5201b98..999cc08e2f544a439ecac56d98de1daa0e2ce54f 100644
17--- a/.github/workflows/project.yml
18+++ b/.github/workflows/project.yml
19@@ -9,6 +9,7 @@ concurrency:
20   group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
21   cancel-in-progress: true
22 
23+permissions: {}
24 jobs:
25   add-to-project:
26     name: Add to project