1. docker
  2. Commit 2b5ffa0b63c76e8bb4ebb253d7e4db5c7af918c0
Browse code

gha: set permissions to read-only by default

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

Sebastiaan van Stijn authored on 2024/07/29 20:22:15
Showing 11 changed files
.github/workflows/.dco.yml
History View file @ 2b5ffa0
... ... 
@@ -3,6 +3,15 @@ name: .dco
3 3
4 4 
 # TODO: hide reusable workflow from the UI. Tracked in https://github.com/community/community/discussions/12025
5 5
6 
+# Default to 'contents: read', which grants actions to read commits.
7 
+#
8 
+# If any permission is set, any permission not included in the list is
9 
+# implicitly set to "none".
10 
+#
11 
+# see https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
12 
+permissions:
13 
+  contents: read
14 
+
6 15 
 on:
7 16 
   workflow_call:
8 17
.github/workflows/.test-prepare.yml
History View file @ 2b5ffa0
... ... 
@@ -3,6 +3,15 @@ name: .test-prepare
3 3
4 4 
 # TODO: hide reusable workflow from the UI. Tracked in https://github.com/community/community/discussions/12025
5 5
6 
+# Default to 'contents: read', which grants actions to read commits.
7 
+#
8 
+# If any permission is set, any permission not included in the list is
9 
+# implicitly set to "none".
10 
+#
11 
+# see https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
12 
+permissions:
13 
+  contents: read
14 
+
6 15 
 on:
7 16 
   workflow_call:
8 17 
     outputs:
.github/workflows/.test.yml
History View file @ 2b5ffa0
... ... 
@@ -3,6 +3,15 @@ name: .test
3 3
4 4 
 # TODO: hide reusable workflow from the UI. Tracked in https://github.com/community/community/discussions/12025
5 5
6 
+# Default to 'contents: read', which grants actions to read commits.
7 
+#
8 
+# If any permission is set, any permission not included in the list is
9 
+# implicitly set to "none".
10 
+#
11 
+# see https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
12 
+permissions:
13 
+  contents: read
14 
+
6 15 
 on:
7 16 
   workflow_call:
8 17 
     inputs:
.github/workflows/.windows.yml
History View file @ 2b5ffa0
... ... 
@@ -3,6 +3,15 @@ name: .windows
3 3
4 4 
 # TODO: hide reusable workflow from the UI. Tracked in https://github.com/community/community/discussions/12025
5 5
6 
+# Default to 'contents: read', which grants actions to read commits.
7 
+#
8 
+# If any permission is set, any permission not included in the list is
9 
+# implicitly set to "none".
10 
+#
11 
+# see https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
12 
+permissions:
13 
+  contents: read
14 
+
6 15 
 on:
7 16 
   workflow_call:
8 17 
     inputs:
.github/workflows/bin-image.yml
History View file @ 2b5ffa0
... ... 
@@ -1,5 +1,14 @@
1 1 
 name: bin-image
2 2
3 
+# Default to 'contents: read', which grants actions to read commits.
4 
+#
5 
+# If any permission is set, any permission not included in the list is
6 
+# implicitly set to "none".
7 
+#
8 
+# see https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
9 
+permissions:
10 
+  contents: read
11 
+
3 12 
 concurrency:
4 13 
   group: ${{ github.workflow }}-${{ github.ref }}
5 14 
   cancel-in-progress: true
.github/workflows/buildkit.yml
History View file @ 2b5ffa0
... ... 
@@ -1,5 +1,14 @@
1 1 
 name: buildkit
2 2
3 
+# Default to 'contents: read', which grants actions to read commits.
4 
+#
5 
+# If any permission is set, any permission not included in the list is
6 
+# implicitly set to "none".
7 
+#
8 
+# see https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
9 
+permissions:
10 
+  contents: read
11 
+
3 12 
 concurrency:
4 13 
   group: ${{ github.workflow }}-${{ github.ref }}
5 14 
   cancel-in-progress: true
.github/workflows/ci.yml
History View file @ 2b5ffa0
... ... 
@@ -1,5 +1,14 @@
1 1 
 name: ci
2 2
3 
+# Default to 'contents: read', which grants actions to read commits.
4 
+#
5 
+# If any permission is set, any permission not included in the list is
6 
+# implicitly set to "none".
7 
+#
8 
+# see https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
9 
+permissions:
10 
+  contents: read
11 
+
3 12 
 concurrency:
4 13 
   group: ${{ github.workflow }}-${{ github.ref }}
5 14 
   cancel-in-progress: true
.github/workflows/test.yml
History View file @ 2b5ffa0
... ... 
@@ -1,5 +1,14 @@
1 1 
 name: test
2 2
3 
+# Default to 'contents: read', which grants actions to read commits.
4 
+#
5 
+# If any permission is set, any permission not included in the list is
6 
+# implicitly set to "none".
7 
+#
8 
+# see https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
9 
+permissions:
10 
+  contents: read
11 
+
3 12 
 concurrency:
4 13 
   group: ${{ github.workflow }}-${{ github.ref }}
5 14 
   cancel-in-progress: true
.github/workflows/validate-pr.yml
History View file @ 2b5ffa0
... ... 
@@ -1,5 +1,14 @@
1 1 
 name: validate-pr
2 2
3 
+# Default to 'contents: read', which grants actions to read commits.
4 
+#
5 
+# If any permission is set, any permission not included in the list is
6 
+# implicitly set to "none".
7 
+#
8 
+# see https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
9 
+permissions:
10 
+  contents: read
11 
+
3 12 
 on:
4 13 
   pull_request:
5 14 
     types: [opened, edited, labeled, unlabeled]
.github/workflows/windows-2019.yml
History View file @ 2b5ffa0
... ... 
@@ -1,5 +1,14 @@
1 1 
 name: windows-2019
2 2
3 
+# Default to 'contents: read', which grants actions to read commits.
4 
+#
5 
+# If any permission is set, any permission not included in the list is
6 
+# implicitly set to "none".
7 
+#
8 
+# see https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
9 
+permissions:
10 
+  contents: read
11 
+
3 12 
 concurrency:
4 13 
   group: ${{ github.workflow }}-${{ github.ref }}
5 14 
   cancel-in-progress: true
.github/workflows/windows-2022.yml
History View file @ 2b5ffa0
... ... 
@@ -1,5 +1,14 @@
1 1 
 name: windows-2022
2 2
3 
+# Default to 'contents: read', which grants actions to read commits.
4 
+#
5 
+# If any permission is set, any permission not included in the list is
6 
+# implicitly set to "none".
7 
+#
8 
+# see https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
9 
+permissions:
10 
+  contents: read
11 
+
3 12 
 concurrency:
4 13 
   group: ${{ github.workflow }}-${{ github.ref }}
5 14 
   cancel-in-progress: true