firebase · naveensrinivasan · Jun 26, 2022
@@ -6,6 +6,9 @@ on:
       - master
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   deploy:
     name: Canary Deploy

@@ -6,8 +6,15 @@ env:
   GITHUB_PULL_REQUEST_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
   GITHUB_PULL_REQUEST_BASE_SHA: ${{ github.event.pull_request.base.sha }}
 
+permissions:
+  contents: read
+
 jobs:
   check_changeset:
+    permissions:
+      contents: read  # for actions/checkout to fetch code
+      issues: write  # for peter-evans/create-or-update-comment to create or update comment
+      pull-requests: write  # for peter-evans/create-or-update-comment to create or update comment
     name: Check changeset vs changed files
     runs-on: ubuntu-latest
 

@@ -2,6 +2,9 @@ name: Test Package Paths
 
 on: pull_request
 
+permissions:
+  contents: read
+
 jobs:
   test:
     name: Test Package Paths

@@ -5,6 +5,9 @@ on:
   repository_dispatch:
     types: [staging-tests]
 
+permissions:
+  contents: read
+
 jobs:
   test:
     name: Run E2E Smoke Tests

@@ -6,6 +6,9 @@ env:
   GITHUB_PULL_REQUEST_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
   GITHUB_PULL_REQUEST_BASE_SHA: ${{ github.event.pull_request.base.sha }}
 
+permissions:
+  contents: read
+
 jobs:
   format:
     name: Run license and prettier formatting tasks

@@ -17,6 +17,9 @@ env:
   GITHUB_PULL_REQUEST_BASE_SHA: ${{ github.event.pull_request.base.sha }}
   NODE_OPTIONS: "--max-old-space-size=4096"
 
+permissions:
+  contents: read
+
 jobs:
   binary-size:
     name: Binary Size

@@ -2,6 +2,9 @@ name: Lint All Packages
 
 on: pull_request
 
+permissions:
+  contents: read
+
 jobs:
   test:
     name: Lint

@@ -9,6 +9,9 @@ on:
             npmTag:
                 description: 'The npm tag to publish to, as in npm install firebase@<npmTag>'
                 required: true
+permissions:
+  contents: read
+
 jobs:
     deploy:
         name: Prerelease Deploy

@@ -6,6 +6,9 @@ on:
       - release
       - '*-releasebranch'
 
+permissions:
+  contents: read
+
 jobs:
   release:
     name: Send PR number to tracker endpoint

@@ -8,8 +8,14 @@ env:
   # make chromedriver detect installed Chrome version and download the corresponding driver
   DETECT_CHROMEDRIVER_VERSION: true
 
+permissions:
+  contents: read
+
 jobs:
   test:
+    permissions:
+      checks: write  # for coverallsapp/github-action to create new checks
+      contents: read  # for actions/checkout to fetch code
     name: Node.js and Browser (Chrome) Tests
     runs-on: ubuntu-latest
 

@@ -6,6 +6,9 @@ env:
   # make chromedriver detect installed Chrome version and download the corresponding driver
   DETECT_CHROMEDRIVER_VERSION: true
 
+permissions:
+  contents: read
+
 jobs:
   test:
     name: Test Auth If Changed

@@ -6,6 +6,9 @@ env:
   # make chromedriver detect installed Chrome version and download the corresponding driver
   DETECT_CHROMEDRIVER_VERSION: true
 
+permissions:
+  contents: read
+
 jobs:
   test:
     name: Test FCM integration If Changed

@@ -2,6 +2,9 @@ name: Test Firestore Integration
 
 on: pull_request
 
+permissions:
+  contents: read
+
 jobs:
   test:
     name: Test Firestore Integration If Changed

@@ -2,6 +2,9 @@ name: Test Firestore
 
 on: pull_request
 
+permissions:
+  contents: read
+
 jobs:
   test:
     name: Test Firestore If Changed

@@ -2,6 +2,9 @@ name: Test @firebase/rules-unit-testing
 
 on: pull_request
 
+permissions:
+  contents: read
+
 jobs:
   test:
     name: Test Misc Packages If Changed

@@ -2,6 +2,9 @@ name: Test Modified Packages
 
 on: pull_request
 
+permissions:
+  contents: read
+
 jobs:
   test:
     name: Test Packages With Changed Files

@@ -2,6 +2,9 @@ name: Test Firebase Namespace
 
 on: pull_request
 
+permissions:
+  contents: read
+
 jobs:
   test:
     name: Test Firebase Namespace