From 99841e1bea5b664cfb6db0616a3488a78a116814 Mon Sep 17 00:00:00 2001 From: Melissa Kilby Date: Fri, 17 Oct 2025 16:15:47 -0700 Subject: [PATCH] chore: restrict GitHub workflow permissions - future-proof Signed-off-by: Melissa Kilby --- .github/workflows/main.yml | 3 +++ .github/workflows/pull_request.yml | 3 +++ .github/workflows/pull_request_label.yml | 3 +++ 3 files changed, 9 insertions(+) diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 6db1fc5d..23798a26 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -1,5 +1,8 @@ name: Main +permissions: + contents: read + on: push: branches: [main] diff --git a/.github/workflows/pull_request.yml b/.github/workflows/pull_request.yml index f3ab7a89..95f4c804 100644 --- a/.github/workflows/pull_request.yml +++ b/.github/workflows/pull_request.yml @@ -1,5 +1,8 @@ name: PR +permissions: + contents: read + on: pull_request: types: [opened, reopened, synchronize] diff --git a/.github/workflows/pull_request_label.yml b/.github/workflows/pull_request_label.yml index 8fd47c13..d2da2f1a 100644 --- a/.github/workflows/pull_request_label.yml +++ b/.github/workflows/pull_request_label.yml @@ -1,5 +1,8 @@ name: PR label +permissions: + contents: read + on: pull_request: types: [labeled, unlabeled, opened, reopened, synchronize]