chore: GitHub Workflows security hardening (#5672)

typescript-eslint · Oct 2, 2022 · 5adf7bd · 5adf7bd
1 parent c8d5cd2
commit 5adf7bd
Show file tree

Hide file tree

Showing 2 changed files with 13 additions and 0 deletions.
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -23,6 +23,9 @@ defaults:
 # 3) Run the steps that depend on the build
 #
 
+permissions:
+  contents: read # to fetch code (actions/checkout)
+
 jobs:
   install:
     name: Checkout and Install
@@ -170,6 +173,10 @@ jobs:
           retention-days: 1
 
   website_tests:
+    permissions:
+      contents: read # to fetch code (actions/checkout)
+      actions: read # to correctly identify workflow run (cypress-io/github-action)
+
     name: Website tests
     needs: [build]
     runs-on: ubuntu-latest

diff --git a/.github/workflows/lock.yml b/.github/workflows/lock.yml
@@ -4,8 +4,14 @@ on:
   schedule:
     - cron: '0 0 * * *'
 
+permissions: {}
+
 jobs:
   lock:
+    permissions:
+      issues: write # to lock issues (dessant/lock-threads)
+      pull-requests: write # to lock PRs (dessant/lock-threads)
+
     runs-on: ubuntu-latest
     steps:
       - uses: dessant/lock-threads@v3