Merge pull request #13750 from Carreau/sec-2

SEC: force workflows to be read-only.
ipython · Sep 9, 2022 · 4f6e132 · 4f6e132
2 parents 06d7872 + ef9f0de
commit 4f6e132
Show file tree

Hide file tree

Showing 4 changed files with 11 additions and 0 deletions.
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
@@ -2,6 +2,9 @@ name: Build docs
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest

diff --git a/.github/workflows/downstream.yml b/.github/workflows/downstream.yml
@@ -8,6 +8,8 @@ on:
   - cron:  '23 1 * * 1'
   workflow_dispatch:
 
+permissions:
+  contents: read
 
 jobs:
   test:

diff --git a/.github/workflows/mypy.yml b/.github/workflows/mypy.yml
@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: [ main, 7.x]
 
+permissions:
+  contents: read
+
 jobs:
   build:
 

diff --git a/.github/workflows/python-package.yml b/.github/workflows/python-package.yml
@@ -3,6 +3,9 @@
 
 name: Python package
 
+permissions:
+  contents: read
+
 on:
   push:
     branches: [ main, 7.x ]