ci: GitHub Workflows security hardening (#5405)

* build: harden ci.yml permissions Signed-off-by: Alex <aleksandrosansan@gmail.com> * build: harden update-latest.yml permissions Signed-off-by: Alex <aleksandrosansan@gmail.com> Signed-off-by: Alex <aleksandrosansan@gmail.com>
pnpm · Sep 24, 2022 · 54540b1 · 54540b1
1 parent 50c6f11
commit 54540b1
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 0 deletions.
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -2,6 +2,9 @@ name: CI
 
 on: [push, pull_request]
 
+permissions:
+  contents: read # to fetch code (actions/checkout)
+
 jobs:
   build:
     strategy:

diff --git a/.github/workflows/update-latest.yml b/.github/workflows/update-latest.yml
@@ -11,6 +11,7 @@ on:
         default: latest
         required: true
 
+permissions: {}
 jobs:
   build:
     name: Tagging ${{ github.event.inputs.version }} as ${{ github.event.inputs.tag }}