Merge pull request #134 from aiven/harden-workflow

fix: Harden workflow
Aiven-Open · Oct 24, 2022 · f9e8500 · f9e8500
2 parents 68434f7 + 5475b83
commit f9e8500
Showing 1 changed file with 17 additions and 13 deletions.
diff --git a/.github/workflows/maven.yml b/.github/workflows/maven.yml
@@ -5,25 +5,29 @@ name: Java CI with Maven
 
 on:
   push:
-    branches: [ "main" ]
+    branches: ["main"]
   pull_request:
-    branches: [ "main" ]
+    branches: ["main"]
+
+permissions:
+  contents: read
 
 jobs:
   build:
     strategy:
       matrix:
-        java-version: [ 11, 17 ]
-        runs-on: [ ubuntu-latest ]
+        java-version: [11, 17]
+        runs-on: [ubuntu-latest]
     name: Jdk ${{ matrix.java-version }}, os ${{ matrix.runs-on }}
     runs-on: ${{ matrix.runs-on }}
     steps:
-    - uses: actions/checkout@v3
-    - name: Set up JDK ${{ matrix.java-version }}
-      uses: actions/setup-java@v3
-      with:
-        java-version: ${{ matrix.java-version }}
-        distribution: 'temurin'
-        cache: maven
-    - name: Build and run tests with Maven
-      run: mvn --batch-mode --update-snapshots verify
+      - uses: actions/checkout@v3
+      - name: Set up JDK ${{ matrix.java-version }}
+        uses: actions/setup-java@v3
+        with:
+          java-version: ${{ matrix.java-version }}
+          distribution: "temurin"
+          cache: maven
+          persist-credentials: false
+      - name: Build and run tests with Maven
+        run: mvn --batch-mode --update-snapshots verify