From 44143663702d949813d0c851d62d17917c2a04d9 Mon Sep 17 00:00:00 2001 From: Quentin McGaw Date: Sun, 29 May 2022 17:11:26 +0000 Subject: [PATCH] chore(ci): restrict permissions to read actions+contents --- .github/workflows/ci.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 5a391b17..4abb2c94 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -33,6 +33,9 @@ on: jobs: verify: runs-on: ubuntu-latest + permissions: + actions: read + contents: read env: DOCKER_BUILDKIT: "1" steps: @@ -84,6 +87,9 @@ jobs: (github.event_name == 'pull_request' && github.actor != 'dependabot[bot]') ) needs: [verify] + permissions: + actions: read + contents: read runs-on: ubuntu-latest steps: - uses: actions/checkout@v3