Skip to content

Commit

Permalink
chore: GitHub Workflows security hardening (#2740)
Browse files Browse the repository at this point in the history
* build: harden tests.yml permissions

Signed-off-by: Alex <[email protected]>

* build: harden release-please.yml permissions

Signed-off-by: Alex <[email protected]>

* build: harden visual-studio.yml permissions

Signed-off-by: Alex <[email protected]>

* Update release-please.yml

---------

Signed-off-by: Alex <[email protected]>
  • Loading branch information
sashashura authored Oct 27, 2023
1 parent 91fd8ff commit 26683e9
Show file tree
Hide file tree
Showing 3 changed files with 12 additions and 0 deletions.
4 changes: 4 additions & 0 deletions .github/workflows/release-please.yml
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,10 @@ on:

jobs:
release-please:
permissions:
contents: write # to create release commit (google-github-actions/release-please-action)
pull-requests: write # to create release PR (google-github-actions/release-please-action)

runs-on: ubuntu-latest
steps:
- uses: google-github-actions/release-please-action@v2
Expand Down
4 changes: 4 additions & 0 deletions .github/workflows/tests.yml
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,10 @@ on:
branches: [ main ]
pull_request:
branches: [ main ]

permissions:
contents: read # to fetch code (actions/checkout)

jobs:
Lint_Python:
runs-on: ubuntu-latest
Expand Down
4 changes: 4 additions & 0 deletions .github/workflows/visual-studio.yml
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,10 @@ on:
branches: [ main ]
pull_request:
branches: [ main ]

permissions:
contents: read # to fetch code (actions/checkout)

jobs:
visual-studio:
strategy:
Expand Down

0 comments on commit 26683e9

Please sign in to comment.