Add read-only top-level workflow permissions (#953)

Signed-off-by: Pedro Kaj Kjellerup Nacht <pnacht@google.com>
FasterXML · Mar 16, 2023 · d26e01f · d26e01f
1 parent 17ce703
commit d26e01f
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 0 deletions.
diff --git a/.github/workflows/cifuzz.yml b/.github/workflows/cifuzz.yml
@@ -1,6 +1,9 @@
 name: CIFuzz
 on: [pull_request]
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }} @ ${{ github.ref }}
   cancel-in-progress: true

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -12,6 +12,9 @@ on:
       - "!*.pr*"
       - "!*b"
 
+permissions:
+  contents: read
+
 jobs:
   release:
     runs-on: "ubuntu-20.04"