ci: tighten codeql and labeler even more

by moving the read permissions to the top level and granting additional permissions to the specific jobs. It should help to prevent new jobs that could be added there eventually from having write access to resources they most likely would never need.
2021-11-14 10:51:07 +00:00
parent b3a1fb795a
commit 510afa460a
2 changed files with 5 additions and 2 deletions
@@ -11,6 +11,9 @@ on:
  schedule:
    - cron: '0 1 * * *'

+permissions:
+  contents: read
+
 jobs:
  analyze:
    name: Analyze
@@ -20,7 +23,6 @@ jobs:
      cancel-in-progress: true
    permissions:
      actions: read
-      contents: read
      security-events: write

    strategy: