From 50985f104661cb494400be61da443fadab5fcc25 Mon Sep 17 00:00:00 2001 From: cpovirk Date: Mon, 3 Aug 2026 09:13:07 -0700 Subject: [PATCH] Enact some security improvements that I'd missed in previous rounds. For each project, that includes some subset of: - `zizmor` fixes (this time for [excessive permissions](https://docs.zizmor.sh/audits/#excessive-permissions)): compare https://github.com/google/auto/commit/754877fad13fa1a23725427b6e22dba0ab625891 (or cl/957369925 for excessive permissions specifically) - migration off `styfle/cancel-workflow-action` (which requires write permissions): compare https://github.com/google/auto/commit/68ac320e3ce57ba08651a2d4351a7ecdf4aa6d74 - Relatedly, set up cancellation for bazel_common using the replacement we're using elsewhere (`concurrency`), since bazel_common didn't have cancellation set up at all yet. - Dependabot `cooldown`: compare https://github.com/google/auto/commit/98540907c8f65524b7a9b12640836670e7898c62 RELNOTES=n/a PiperOrigin-RevId: 958410064 --- .github/workflows/ci.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 5297114a2a..9c320452ff 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -13,6 +13,9 @@ concurrency: group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }} cancel-in-progress: true +permissions: + contents: read + jobs: test: name: "JDK ${{ matrix.java }}"