From 3eb748ff1f2ef668339f2b07cb59a13ce221ab4e Mon Sep 17 00:00:00 2001 From: Alex Date: Sun, 25 Sep 2022 18:07:10 +0200 Subject: [PATCH 1/3] build: harden promote.yml permissions Signed-off-by: Alex --- .github/workflows/promote.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/promote.yml b/.github/workflows/promote.yml index 768cb8533b..b792cce14d 100644 --- a/.github/workflows/promote.yml +++ b/.github/workflows/promote.yml @@ -4,6 +4,9 @@ on: release: types: [published] +permissions: + contents: read # to fetch code (actions/checkout) + jobs: promote: runs-on: ubuntu-latest From 21291b53fda8d61f8a129f270059504b608f43d7 Mon Sep 17 00:00:00 2001 From: Alex Date: Sun, 25 Sep 2022 18:10:53 +0200 Subject: [PATCH 2/3] build: harden label_pr.yml permissions Signed-off-by: Alex --- .github/workflows/label_pr.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/label_pr.yml b/.github/workflows/label_pr.yml index 8e3f8b81a2..cd6036958f 100644 --- a/.github/workflows/label_pr.yml +++ b/.github/workflows/label_pr.yml @@ -7,6 +7,10 @@ on: - reopened - synchronize +permissions: + contents: read # to determine modified files (actions/labeler) + pull-requests: write # to add labels to PRs (actions/labeler) + jobs: triage: runs-on: ubuntu-latest From b3bda415da6b91865ee371bf27e97f7dc0992c04 Mon Sep 17 00:00:00 2001 From: Alex Date: Sun, 25 Sep 2022 18:12:14 +0200 Subject: [PATCH 3/3] build: harden label_issue.yml permissions Signed-off-by: Alex --- .github/workflows/label_issue.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/label_issue.yml b/.github/workflows/label_issue.yml index ead15724bb..d5b00d1d29 100644 --- a/.github/workflows/label_issue.yml +++ b/.github/workflows/label_issue.yml @@ -6,6 +6,10 @@ on: - opened - reopened + permissions: + contents: read # to fetch code + issues: write # to label issues + jobs: triage: runs-on: ubuntu-latest