From e47115953f2b1366ac53f8cfa6f6bc37cda31aac Mon Sep 17 00:00:00 2001 From: Alex Date: Mon, 26 Sep 2022 20:21:19 +0200 Subject: [PATCH 1/3] build: harden about-files-ci.yml permissions Signed-off-by: Alex --- .github/workflows/about-files-ci.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/about-files-ci.yml b/.github/workflows/about-files-ci.yml index e3a1b5b1dec..268c9565211 100644 --- a/.github/workflows/about-files-ci.yml +++ b/.github/workflows/about-files-ci.yml @@ -2,6 +2,9 @@ name: CI About Files on: [push, pull_request] +permissions: + contents: read # to fetch code (actions/checkout) + jobs: build: runs-on: ubuntu-20.04 From 74694e181a4c86221d16f5ee5e7c67b98a12b4ae Mon Sep 17 00:00:00 2001 From: Alex Date: Mon, 26 Sep 2022 20:26:47 +0200 Subject: [PATCH 2/3] build: harden scancode-release.yml permissions Signed-off-by: Alex --- .github/workflows/scancode-release.yml | 34 ++++++++++++++++++++++++++ 1 file changed, 34 insertions(+) diff --git a/.github/workflows/scancode-release.yml b/.github/workflows/scancode-release.yml index 49e2ad788e6..a01fbc570ff 100644 --- a/.github/workflows/scancode-release.yml +++ b/.github/workflows/scancode-release.yml @@ -17,9 +17,13 @@ on: tags: - "v*.*.*" +permissions: {} jobs: build_scancode_for_pypi: + permissions: + contents: read # to fetch code (actions/checkout) + name: Build PyPI archives runs-on: ubuntu-20.04 @@ -67,6 +71,9 @@ jobs: build_scancode_for_release_linux: + permissions: + contents: read # to fetch code (actions/checkout) + name: Build Release for linux runs-on: ubuntu-20.04 needs: @@ -106,6 +113,9 @@ jobs: build_scancode_for_release_macos: + permissions: + contents: read # to fetch code (actions/checkout) + name: Build Release for mac runs-on: ubuntu-20.04 needs: @@ -145,6 +155,9 @@ jobs: build_scancode_for_release_windows: + permissions: + contents: read # to fetch code (actions/checkout) + name: Build Release for windows runs-on: ubuntu-20.04 needs: @@ -183,6 +196,9 @@ jobs: build_scancode_for_release_source: + permissions: + contents: read # to fetch code (actions/checkout) + name: Build source runs-on: ubuntu-20.04 needs: @@ -221,6 +237,9 @@ jobs: smoke_test_install_and_run_pypi_dists_posix: + permissions: + contents: read # to fetch code (actions/checkout) + name: Test POSIX PyPI wheels needs: - build_scancode_for_pypi @@ -267,6 +286,9 @@ jobs: smoke_test_install_and_run_pypi_dists_windows: + permissions: + contents: read # to fetch code (actions/checkout) + name: Test Windows PyPI wheels needs: - build_scancode_for_pypi @@ -312,6 +334,9 @@ jobs: smoke_test_install_and_run_app_archives_on_linux: + permissions: + contents: read # to fetch code (actions/checkout) + name: Test app on ${{ matrix.os }} needs: - build_scancode_for_release_linux @@ -350,6 +375,9 @@ jobs: smoke_test_install_and_run_app_archives_on_macos: + permissions: + contents: read # to fetch code (actions/checkout) + name: Test app on ${{ matrix.os }} needs: - build_scancode_for_release_macos @@ -388,6 +416,9 @@ jobs: smoke_test_install_and_run_app_archives_on_windows: + permissions: + contents: read # to fetch code (actions/checkout) + name: Test app on ${{ matrix.os }} needs: - build_scancode_for_release_windows @@ -422,6 +453,9 @@ jobs: for %%F in (dist/*.zip) do python etc/release/scancode_release_tests.py dist/%%F publish_to_gh_release: + permissions: + contents: write # to create GitHub release (softprops/action-gh-release) + name: Publish to GH Release needs: - smoke_test_install_and_run_app_archives_on_linux From dae4189914ca740470092162fdfde45243b26a6e Mon Sep 17 00:00:00 2001 From: Alex Date: Mon, 26 Sep 2022 20:27:12 +0200 Subject: [PATCH 3/3] build: harden docs-ci.yml permissions Signed-off-by: Alex --- .github/workflows/docs-ci.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/docs-ci.yml b/.github/workflows/docs-ci.yml index 18a44aa0846..b8b9b869204 100644 --- a/.github/workflows/docs-ci.yml +++ b/.github/workflows/docs-ci.yml @@ -2,6 +2,9 @@ name: CI Documentation on: [push, pull_request] +permissions: + contents: read # to fetch code (actions/checkout) + jobs: build: runs-on: ubuntu-20.04