[StepSecurity] ci: Harden GitHub Actions (#1320)

Signed-off-by: StepSecurity Bot <bot@stepsecurity.io>
apache · Apr 8, 2024 · aadfff9 · aadfff9
1 parent c7f2143
commit aadfff9
Show file tree

Hide file tree

Showing 5 changed files with 15 additions and 0 deletions.
diff --git a/.github/workflows/docker-build.yml b/.github/workflows/docker-build.yml
@@ -14,6 +14,9 @@ on:
 env:
   MAVEN_OPTS: -Dmaven.wagon.httpconnectionManager.ttlSeconds=60
 
+permissions:
+  contents: read
+
 jobs:
   build:
     strategy:

diff --git a/.github/workflows/example.yml b/.github/workflows/example.yml
@@ -11,6 +11,9 @@ on:
     paths:
       - 'examples/**'
 
+permissions:
+  contents: read
+
 jobs:
   build:
 

diff --git a/.github/workflows/java.yml b/.github/workflows/java.yml
@@ -27,6 +27,9 @@ on:
 env:
   MAVEN_OPTS: -Dmaven.wagon.httpconnectionManager.ttlSeconds=60
 
+permissions:
+  contents: read
+
 jobs:
   build:
 

diff --git a/.github/workflows/python-extension.yml b/.github/workflows/python-extension.yml
@@ -20,6 +20,9 @@ on:
       - 'pom.xml'
       - 'python/**'
 
+permissions:
+  contents: read
+
 jobs:
   build:
     strategy:

diff --git a/.github/workflows/python.yml b/.github/workflows/python.yml
@@ -26,6 +26,9 @@ env:
   JAI_CODEC_VERSION: "1.1.3"
   JAI_IMAGEIO_VERSION: "1.1"
 
+permissions:
+  contents: read
+
 jobs:
   build: