ci: restrict permissions

jfmengels · Jul 4, 2024 · 0b53682 · 0b53682
1 parent f4f9e4a
commit 0b53682
Show file tree

Hide file tree

Showing 4 changed files with 21 additions and 0 deletions.
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
@@ -4,6 +4,9 @@ name: CI
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 # A workflow run is made up of one or more jobs that can run sequentially or in parallel
 jobs:
   test:

diff --git a/new-package/github/workflows/test.yml b/new-package/github/workflows/test.yml
@@ -4,6 +4,9 @@ name: CI
 # events but only for the main branch
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 # A workflow run is made up of one or more jobs that can run sequentially or in parallel
 jobs:
   test:
@@ -64,6 +67,9 @@ jobs:
   publish:
     needs: [test] # make sure all your other jobs succeed before trying to publish
 
+    permissions:
+      contents: write
+
     # The type of runner that the job will run on
     runs-on: ubuntu-latest
 

diff --git a/test/run-snapshots/elm-review-something-for-new-rule/.github/workflows/test.yml b/test/run-snapshots/elm-review-something-for-new-rule/.github/workflows/test.yml
@@ -4,6 +4,9 @@ name: CI
 # events but only for the main branch
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 # A workflow run is made up of one or more jobs that can run sequentially or in parallel
 jobs:
   test:
@@ -64,6 +67,9 @@ jobs:
   publish:
     needs: [test] # make sure all your other jobs succeed before trying to publish
 
+    permissions:
+      contents: write
+
     # The type of runner that the job will run on
     runs-on: ubuntu-latest
 

diff --git a/test/run-snapshots/elm-review-something/.github/workflows/test.yml b/test/run-snapshots/elm-review-something/.github/workflows/test.yml
@@ -4,6 +4,9 @@ name: CI
 # events but only for the main branch
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 # A workflow run is made up of one or more jobs that can run sequentially or in parallel
 jobs:
   test:
@@ -64,6 +67,9 @@ jobs:
   publish:
     needs: [test] # make sure all your other jobs succeed before trying to publish
 
+    permissions:
+      contents: write
+
     # The type of runner that the job will run on
     runs-on: ubuntu-latest