Skip to content

Commit 74a27f8

Browse files
tacaswelltacaswell
committed
CI: Restrict default permissions
Reduces risk of arbitrary code is run by attacker.
1 parent b4c19d8 commit 74a27f8

File tree

4 files changed

+8
-0
lines changed

4 files changed

+8
-0
lines changed

‎.github/workflows/lint.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,6 @@
11
name: Lint
2+
permissions:
3+
contents: read
24

35
on:
46
push:

‎{{cookiecutter.github_project_name}}/.github/workflows/lint.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,6 @@
11
name: Lint
2+
permissions:
3+
contents: read
24

35
on:
46
push:

‎{{cookiecutter.github_project_name}}/.github/workflows/publish.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,7 @@
11
# heavily based on https://github.com/jupyterlab/jupyterlab-git/blob/v0.22.2/.github/workflows/publish.yml
22
name: Publish Package
3+
permissions:
4+
contents: read
35

46
on:
57
release:

‎{{cookiecutter.github_project_name}}/.github/workflows/test.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,6 @@
11
name: Test
2+
permissions:
3+
contents: read
24

35
on:
46
push:

0 commit comments

Comments
 (0)