Add minimal permissions to some actions workflows

ponylang · Jan 26, 2025 · 770cc04 · 770cc04
1 parent b8b4f1f
commit 770cc04
Show file tree

Hide file tree

Showing 4 changed files with 14 additions and 0 deletions.
diff --git a/.github/workflows/announce-a-release.yml b/.github/workflows/announce-a-release.yml
@@ -4,6 +4,10 @@ on:
   push:
     tags: 'announce-[0-9]+.[0-9]+.[0-9]+'
 
+permissions:
+  packages: read
+  contents: write
+
 jobs:
   announce:
     name: Announcements

diff --git a/.github/workflows/breakage-against-ponyc-latest.yml b/.github/workflows/breakage-against-ponyc-latest.yml
@@ -4,6 +4,9 @@ on:
   repository_dispatch:
     types: [shared-docker-linux-builders-updated]
 
+permissions:
+  packages: read
+
 jobs:
   vs-latest-ponyc:
     name: Verify main against the latest ponyc

diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
@@ -6,6 +6,9 @@ concurrency:
   group: pr-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  packages: read
+
 jobs:
   superlinter:
     name: Lint bash, docker, markdown, and yaml

diff --git a/.github/workflows/prepare-for-a-release.yml b/.github/workflows/prepare-for-a-release.yml
@@ -4,6 +4,10 @@ on:
   push:
     tags: 'release-[0-9]+.[0-9]+.[0-9]+'
 
+permissions:
+  packages: read
+  contents: write
+
 jobs:
   # all tasks that need to be done before we add an X.Y.Z tag
   # should be done as a step in the pre-tagging job.