From acedf313a9409733c73c1062f028830236801c09 Mon Sep 17 00:00:00 2001
From: Alex <aleksandrosansan@gmail.com>
Date: Fri, 23 Dec 2022 14:55:00 +0200
Subject: [PATCH] GitHub Workflows security hardening (#1193)

* build: harden validate.yml permissions

Signed-off-by: Alex <aleksandrosansan@gmail.com>

* Update validate.yml

Signed-off-by: Alex <aleksandrosansan@gmail.com>
Co-authored-by: Sebastian Silbermann <silbermann.sebastian@gmail.com>
---
 .github/workflows/validate.yml | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml
index a0053f55..8d626849 100644
--- a/.github/workflows/validate.yml
+++ b/.github/workflows/validate.yml
@@ -12,8 +12,14 @@ on:
       - 'alpha'
       - '!all-contributors/**'
   pull_request: {}
+
+permissions: {}
+
 jobs:
   main:
+    permissions:
+      actions: write #  to cancel/stop running workflows (styfle/cancel-workflow-action)
+      contents: read #  to fetch code (actions/checkout)
     # ignore all-contributors PRs
     if: ${{ !contains(github.head_ref, 'all-contributors') }}
     strategy:
@@ -56,6 +62,10 @@ jobs:
           flags: node-${{ matrix.node }}
 
   release:
+    permissions:
+      actions: write #  to cancel/stop running workflows (styfle/cancel-workflow-action)
+      contents: write #  to create release tags (cycjimmy/semantic-release-action)
+
     needs: main
     runs-on: ubuntu-latest
     if: