ci(benchmark): reduce workflow permissions (#403)

fastify · Apr 13, 2022 · 1200831 · 1200831
1 parent 3b6547f
commit 1200831
Showing 1 changed file with 5 additions and 1 deletion.
diff --git a/.github/workflows/benchmark.yml b/.github/workflows/benchmark.yml
@@ -1,13 +1,15 @@
 name: Benchmark
 
 on:
-  pull_request_target:
+  pull_request:
     types: [labeled]
 
 jobs:
   benchmark:
     if: ${{ github.event.label.name == 'benchmark' }}
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     outputs:
       PR-BENCH-12: ${{ steps.benchmark-pr.outputs.BENCH_RESULT12 }}
       PR-BENCH-14: ${{ steps.benchmark-pr.outputs.BENCH_RESULT14 }}
@@ -64,6 +66,8 @@ jobs:
   output-benchmark:
     needs: [benchmark]
     runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
     steps:
       - name: Comment PR
         uses: thollander/actions-comment-pull-request@v1