Merge pull request #946 from chromaui/action-permissions

Restrict permissions in GitHub Action workflows

.github/workflows/check-labels.yml

@@ -3,6 +3,8 @@ on:
   pull_request:
     types: [opened, labeled, unlabeled, synchronize]
 
+permissions: {}
+
 jobs:
   check-labels:
     runs-on: ubuntu-latest

.github/workflows/chromatic-main-and-prs.yml

@@ -6,6 +6,9 @@ on:
   pull_request:
     types: [assigned, ready_for_review, review_requested]
 
+permissions:
+  contents: read
+
 jobs:
   chromatic:
     runs-on: ubuntu-latest

.github/workflows/chromatic-prod.yml

@@ -1,6 +1,9 @@
 name: Chromatic
 on: push
 
+permissions:
+  contents: read
+
 jobs:
   chromatic:
     runs-on: ubuntu-latest

.github/workflows/chromatic-staging.yml

@@ -1,6 +1,9 @@
 name: Chromatic (staging)
 on: push
 
+permissions:
+  contents: read
+
 jobs:
   chromatic:
     runs-on: ubuntu-latest

.github/workflows/release.yml

@@ -21,6 +21,10 @@ on:
       - package.json
       - storybook-addon.*
 
+permissions:
+  contents: write
+  pull-requests: write
+
 jobs:
   release:
     runs-on: ubuntu-latest

.github/workflows/smoke-test-action.yml

@@ -1,6 +1,9 @@
 name: Smoke test via action
 on: push
 
+permissions:
+  contents: read
+
 jobs:
   self-test:
     runs-on: ubuntu-latest

.github/workflows/smoke-test-node-api.yml

@@ -1,6 +1,9 @@
 name: Smoke test via node api
 on: push
 
+permissions:
+  contents: read
+
 jobs:
   self-test:
     runs-on: ubuntu-latest

.github/workflows/smoke-test-node18.yml

@@ -1,6 +1,9 @@
 name: Smoke test via Node 18
 on: push
 
+permissions:
+  contents: read
+
 jobs:
   self-test:
     runs-on: ubuntu-latest

.github/workflows/smoke-test-node20.yml

@@ -1,6 +1,9 @@
 name: Smoke test via Node 20
 on: push
 
+permissions:
+  contents: read
+
 jobs:
   self-test:
     runs-on: ubuntu-latest

.github/workflows/smoke-test-npx.yml

@@ -1,6 +1,9 @@
 name: Smoke test via npx
 on: push
 
+permissions:
+  contents: read
+
 jobs:
   chromatic:
     runs-on: ubuntu-latest

.github/workflows/smoke-test-windows.yml

@@ -1,6 +1,9 @@
 name: Smoke test via yarn on Windows
 on: push
 
+permissions:
+  contents: read
+
 jobs:
   chromatic:
     runs-on: windows-latest

.github/workflows/smoke-test-yarn-berry.yml

@@ -1,6 +1,9 @@
 name: Smoke test via yarn berry
 on: push
 
+permissions:
+  contents: read
+
 jobs:
   chromatic:
     runs-on: ubuntu-latest

.github/workflows/smoke-test-yarn-canary.yml

@@ -1,6 +1,9 @@
 name: Smoke test via yarn canary
 on: push
 
+permissions:
+  contents: read
+
 jobs:
   chromatic:
     runs-on: ubuntu-latest

.github/workflows/smoke-test-yarn-classic.yml

@@ -1,6 +1,9 @@
 name: Smoke test via yarn classic
 on: push
 
+permissions:
+  contents: read
+
 jobs:
   chromatic:
     runs-on: ubuntu-latest

.github/workflows/smoke-test-yarn.yml

@@ -1,6 +1,9 @@
 name: Smoke test via yarn
 on: push
 
+permissions:
+  contents: read
+
 jobs:
   self-test:
     runs-on: ubuntu-latest