From e7a966915dde2c6f25a5e7a06a4a637b04b89781 Mon Sep 17 00:00:00 2001 From: Evgeny Vereshchagin Date: Sat, 13 Nov 2021 22:34:04 +0000 Subject: [PATCH] ci: mimic the "restricted" mode Judging by https://docs.github.com/en/actions/security-guides/automatic-token-authentication#permissions-for-the-github_token it should be enough to grant the "read contents" permission to most of our actions. The "read metadata" permission is set impliciclty somewhere and can't be set via the "permissions" setting: ``` The workflow is not valid. .github/workflows/linter.yml (Line: 14, Col: 3): Unexpected value 'metadata' ``` --- .github/workflows/build_test.yml | 3 ++- .github/workflows/cifuzz.yml | 3 ++- .github/workflows/coverity.yml | 3 ++- .github/workflows/linter.yml | 3 ++- .github/workflows/mkosi.yml | 3 ++- .github/workflows/unit_tests.yml | 3 ++- 6 files changed, 12 insertions(+), 6 deletions(-) diff --git a/.github/workflows/build_test.yml b/.github/workflows/build_test.yml index c446fc41ba..887dfabf05 100644 --- a/.github/workflows/build_test.yml +++ b/.github/workflows/build_test.yml @@ -12,7 +12,8 @@ on: - 'src/**' - 'test/fuzz/**' -permissions: read-all +permissions: + contents: read jobs: build: diff --git a/.github/workflows/cifuzz.yml b/.github/workflows/cifuzz.yml index 6c02b1da1e..25a1a6ebeb 100644 --- a/.github/workflows/cifuzz.yml +++ b/.github/workflows/cifuzz.yml @@ -5,7 +5,8 @@ name: CIFuzz -permissions: read-all +permissions: + contents: read on: pull_request: diff --git a/.github/workflows/coverity.yml b/.github/workflows/coverity.yml index 7b1d1217f3..a164d16fbf 100644 --- a/.github/workflows/coverity.yml +++ b/.github/workflows/coverity.yml @@ -9,7 +9,8 @@ on: # Run Coverity daily at midnight - cron: '0 0 * * *' -permissions: read-all +permissions: + contents: read jobs: build: diff --git a/.github/workflows/linter.yml b/.github/workflows/linter.yml index 3905b7a643..7bceabd5ce 100644 --- a/.github/workflows/linter.yml +++ b/.github/workflows/linter.yml @@ -10,7 +10,8 @@ on: - main - v[0-9]+-stable -permissions: read-all +permissions: + contents: read jobs: build: diff --git a/.github/workflows/mkosi.yml b/.github/workflows/mkosi.yml index 533c8be968..6294742758 100644 --- a/.github/workflows/mkosi.yml +++ b/.github/workflows/mkosi.yml @@ -14,7 +14,8 @@ on: - main - v[0-9]+-stable -permissions: read-all +permissions: + contents: read jobs: ci: diff --git a/.github/workflows/unit_tests.yml b/.github/workflows/unit_tests.yml index 3f37fe866b..1458732d2b 100644 --- a/.github/workflows/unit_tests.yml +++ b/.github/workflows/unit_tests.yml @@ -9,7 +9,8 @@ on: - main - v[0-9]+-stable -permissions: read-all +permissions: + contents: read jobs: build: