From c8e39523c3786e1689766272e236d45e1128268e Mon Sep 17 00:00:00 2001 From: Step Security Bot Date: Mon, 31 Oct 2022 10:42:18 -0700 Subject: [PATCH] [StepSecurity] ci: Harden GitHub Actions (#8496) Signed-off-by: StepSecurity Bot --- .github/workflows/packages.yaml | 5 +++++ .github/workflows/tests.yaml | 3 +++ 2 files changed, 8 insertions(+) diff --git a/.github/workflows/packages.yaml b/.github/workflows/packages.yaml index 750129103..2f0cce827 100644 --- a/.github/workflows/packages.yaml +++ b/.github/workflows/packages.yaml @@ -7,8 +7,13 @@ on: types: [released, prereleased] workflow_dispatch: +permissions: # added using https://github.com/step-security/secure-workflows + contents: read + jobs: binary: + permissions: + contents: write # for actions/upload-release-asset to upload release asset strategy: matrix: include: diff --git a/.github/workflows/tests.yaml b/.github/workflows/tests.yaml index 179e84347..e76f0a7e6 100644 --- a/.github/workflows/tests.yaml +++ b/.github/workflows/tests.yaml @@ -17,6 +17,9 @@ concurrency: group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }} cancel-in-progress: true +permissions: # added using https://github.com/step-security/secure-workflows + contents: read + jobs: lint: timeout-minutes: 10