Add read constraints on read-only jobs

boto · Jul 21, 2023 · f5c2638 · f5c2638
1 parent 5799953
commit f5c2638
Show file tree

Hide file tree

Showing 3 changed files with 9 additions and 0 deletions.
diff --git a/.github/workflows/fail-master-prs.yml b/.github/workflows/fail-master-prs.yml
@@ -4,6 +4,9 @@ on:
   pull_request:
     branches: [ master ]
 
+permissions:
+  contents: read
+
 jobs:
   fail:
     runs-on: ubuntu-latest

diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
@@ -5,6 +5,9 @@ on:
   pull_request:
     branches-ignore: [ master ]
 
+permissions:
+  contents: read
+
 jobs:
   lint:
     runs-on: ubuntu-20.04

diff --git a/.github/workflows/run-tests.yml b/.github/workflows/run-tests.yml
@@ -5,6 +5,9 @@ on:
   pull_request:
     branches-ignore: [ master ]
 
+permissions:
+  contents: read
+
 jobs:
   build: