Merge pull request #1534 from aquaproj/ci/fix-permissions

ci: remove contents: read
aquaproj · Jan 6, 2023 · 2efd033 · 2efd033
2 parents 7a339bc + 259b0d2
commit 2efd033
Show file tree

Hide file tree

Showing 5 changed files with 8 additions and 11 deletions.
diff --git a/.github/workflows/actionlint.yaml b/.github/workflows/actionlint.yaml
@@ -11,8 +11,7 @@ on:
     branches: [main]
     paths:
     - .github/**
-permissions:
-  contents: read
+permissions: {}
 jobs:
   default:
     runs-on: ubuntu-latest

diff --git a/.github/workflows/integration-test.yaml b/.github/workflows/integration-test.yaml
@@ -11,8 +11,7 @@ env:
   AQUA_LOG_LEVEL: debug
   AQUA_LOG_COLOR: always
   AQUA_POLICY_CONFIG: ${{ github.workspace }}/aqua-policy.yaml
-permissions:
-  contents: read
+permissions: {}
 jobs:
   build:
     runs-on: ubuntu-latest

diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
@@ -3,16 +3,17 @@ name: Release
 on:
   push:
     tags: [v*]
-permissions:
-  contents: write # required to create a release
-  id-token: write # required for cosign
+permissions: {}
 env:
   AQUA_POLICY_CONFIG: ${{ github.workspace }}/aqua-policy.yaml
 jobs:
   build:
     runs-on: ubuntu-latest
     outputs:
       hashes: ${{ steps.hash.outputs.hashes }}
+    permissions:
+      contents: write # required to create a release
+      id-token: write # required for cosign
     steps:
       - uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
       - uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v3.5.0

diff --git a/.github/workflows/renovate-config-validator.yaml b/.github/workflows/renovate-config-validator.yaml
@@ -1,7 +1,6 @@
 name: renovate-config-validator
 
-permissions:
-  contents: read
+permissions: {}
 
 on:
   pull_request:

diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
@@ -7,8 +7,7 @@ on:
     branches: [main]
   pull_request:
     branches: [main]
-permissions:
-  contents: read
+permissions: {}
 jobs:
   build:
     runs-on: ubuntu-latest