Add explicit permissions to workflow/job

Kesin11 · Dec 27, 2024 · cd3755d · cd3755d
1 parent 4e92944
commit cd3755d
Show file tree

Hide file tree

Showing 3 changed files with 13 additions and 0 deletions.
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -6,6 +6,8 @@ on:
       - "**.md"
       - "renovate.json"
       - "Jenkinsfile"
+permissions:
+  contents: read
 
 jobs:
   check_generated_files:
@@ -43,6 +45,9 @@ jobs:
     runs-on: ubuntu-latest
     container:
       image: "node:lts"
+    permissions:
+      contents: read
+      pull-requests: write
     steps:
       # Setup
       - uses: actions/checkout@v4

diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
@@ -10,6 +10,9 @@ on:
 jobs:
   docker-push:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
     steps:
       - uses: actions/checkout@v4
       - uses: earthly/actions-setup@43211c7a0eae5344d6d79fb4aaf209c8f8866203 # v1.0.13

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -4,9 +4,12 @@ on:
     branches:
       - master
   workflow_dispatch:
+
 jobs:
   draft_release:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     outputs:
       tag_name: ${{ steps.release-drafter.outputs.tag_name }}
     steps:
@@ -21,6 +24,8 @@ jobs:
     runs-on: ubuntu-latest
     if: github.event_name == 'workflow_dispatch'
     needs: draft_release
+    permissions:
+      contents: write
     steps:
       # Create version string from tag (v1.0.0 -> 1.0.0)
       - name: Create version string