Restrict permissions of GITHUB_TOKEN

This changes the default permissions for the GITHUB_TOKEN used in our GitHub Actions configuration to the minimum required to successfully run.
cisagov · Oct 28, 2024 · e93d92a · e93d92a
1 parent f0e55b3
commit e93d92a
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
@@ -30,6 +30,7 @@ env:
 jobs:
   diagnostics:
     name: Run diagnostics
+    permissions: {}
     runs-on: ubuntu-latest
     steps:
       # Note that a duplicate of this step must be added at the top of
@@ -48,6 +49,8 @@ jobs:
   lint:
     needs:
       - diagnostics
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
     steps:
       - id: harden-runner