security: add permissions block to GH workflows (#202)

We want to set the default permissions for workflows to read-only for contents. This is a security measure to prevent accidental changes to the repository. This change adds a top-level permissions block to all workflows in the .github/workflows directory.
elastic · Feb 22, 2024 · 5327ef7 · 5327ef7
1 parent 92fd1d4
commit 5327ef7
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 0 deletions.
diff --git a/.github/workflows/changelog.yml b/.github/workflows/changelog.yml
@@ -6,6 +6,9 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 jobs:
   check:
     if: "!contains(github.event.pull_request.labels.*.name, 'skip-changelog')"

diff --git a/.github/workflows/go.yml b/.github/workflows/go.yml
@@ -6,6 +6,9 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 jobs:
   check:
     runs-on: ubuntu-latest