From 5adf7bdc2ffed554a61fcf0d7d2051a2d7e73c84 Mon Sep 17 00:00:00 2001
From: Alex <aleksandrosansan@gmail.com>
Date: Sun, 2 Oct 2022 04:03:48 +0300
Subject: [PATCH] chore: GitHub Workflows security hardening (#5672)

---
 .github/workflows/ci.yml   | 7 +++++++
 .github/workflows/lock.yml | 6 ++++++
 2 files changed, 13 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1e3c54674c4..0d47090d634 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -23,6 +23,9 @@ defaults:
 # 3) Run the steps that depend on the build
 #
 
+permissions:
+  contents: read # to fetch code (actions/checkout)
+
 jobs:
   install:
     name: Checkout and Install
@@ -170,6 +173,10 @@ jobs:
           retention-days: 1
 
   website_tests:
+    permissions:
+      contents: read # to fetch code (actions/checkout)
+      actions: read # to correctly identify workflow run (cypress-io/github-action)
+
     name: Website tests
     needs: [build]
     runs-on: ubuntu-latest
diff --git a/.github/workflows/lock.yml b/.github/workflows/lock.yml
index 4b73d71b7a0..fc8cea8a8ac 100644
--- a/.github/workflows/lock.yml
+++ b/.github/workflows/lock.yml
@@ -4,8 +4,14 @@ on:
   schedule:
     - cron: '0 0 * * *'
 
+permissions: {}
+
 jobs:
   lock:
+    permissions:
+      issues: write # to lock issues (dessant/lock-threads)
+      pull-requests: write # to lock PRs (dessant/lock-threads)
+
     runs-on: ubuntu-latest
     steps:
       - uses: dessant/lock-threads@v3