GitHub Workflows security hardening (#1894)

* build: harden continuous-integration.yml permissions Signed-off-by: Alex <aleksandrosansan@gmail.com> * build: harden website.yml permissions Signed-off-by: Alex <aleksandrosansan@gmail.com> --------- Signed-off-by: Alex <aleksandrosansan@gmail.com>
TypeStrong · Feb 6, 2023 · a7a7bd4 · a7a7bd4
1 parent 02aee9c
commit a7a7bd4
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 0 deletions.
diff --git a/.github/workflows/continuous-integration.yml b/.github/workflows/continuous-integration.yml
@@ -12,6 +12,8 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
+permissions:
+  contents: read # to fetch code (actions/checkout)
 jobs:
   lint-build:
     name: "Lint & Build"

diff --git a/.github/workflows/website.yml b/.github/workflows/website.yml
@@ -4,8 +4,11 @@ on:
   push:
     branches:
       - docs
+permissions: {}
 jobs:
   build:
+    permissions:
+      contents: write
     name: Build & Deploy
     runs-on: ubuntu-20.04
     steps: