ci: add minimal permissions to workflows bump.yml and release.yml (#245)

Signed-off-by: Diogo Teles Sant'Anna <diogoteles@google.com>
certifi · Sep 7, 2023 · 7f0e639 · 7f0e639
1 parent 600713d
commit 7f0e639
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 0 deletions.
diff --git a/.github/workflows/bump.yml b/.github/workflows/bump.yml
@@ -6,10 +6,16 @@ on:
     # Run daily
     - cron: "0 0 * * *"
 
+permissions:
+  contents: read
+
 jobs:
   bump:
     if: github.repository_owner == 'certifi'
     runs-on: ubuntu-latest
+    permissions:
+      contents: write  # for peter-evans/create-pull-request to create branch
+      pull-requests: write  # for peter-evans/create-pull-request to create a PR
     steps:
       - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
       - run: make update

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -6,6 +6,9 @@ on:
 
 name: release
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Build distributions for PyPI