diff options
| author | Naveen <172697+naveensrinivasan@users.noreply.github.com> | 2022-06-14 09:09:50 +0300 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2022-06-14 09:09:50 +0300 |
| commit | 090ab03a1b84b57676517889db3d081958faf7d5 (patch) | |
| tree | 755345035308294c96f173932faa0941ee3992e4 | |
| parent | ca264770fd14ce614a3d1ce03676116dd691b051 (diff) | |
chore: Set permissions for GitHub actions (#8566)
Restrict the GitHub token permissions only to the required ones; this way, even if the attackers will succeed in compromising your workflow, they won’t be able to do much.
- Included permissions for the action. https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions
https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
https://docs.github.com/en/actions/using-jobs/assigning-permissions-to-jobs
[Keeping your GitHub Actions and workflows secure Part 1: Preventing pwn requests](https://securitylab.github.com/research/github-actions-preventing-pwn-requests/)
Signed-off-by: naveen <172697+naveensrinivasan@users.noreply.github.com>
| -rw-r--r-- | .github/workflows/browser_tests.yml | 3 | ||||
| -rw-r--r-- | .github/workflows/tests.yml | 3 |
2 files changed, 6 insertions, 0 deletions
diff --git a/.github/workflows/browser_tests.yml b/.github/workflows/browser_tests.yml index 8c1308f7f..2844a5609 100644 --- a/.github/workflows/browser_tests.yml +++ b/.github/workflows/browser_tests.yml @@ -4,6 +4,9 @@ on: push: pull_request: +permissions: + contents: read + jobs: browser_tests: runs-on: ubuntu-latest diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index a9b13e330..d6aedbadd 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -4,6 +4,9 @@ on: push: pull_request: +permissions: + contents: read + jobs: linux_tests: runs-on: ubuntu-latest |