feat: Ttt

.github/workflows/build-image-test.yaml

@@ -8,7 +8,8 @@ env:
   IMAGE_TAG: pr-test
 
 permissions:
-  contents: read
+  contents: none
+  # contents: read  # To read Dockerfile and codebase
 
 jobs:
   build:

.github/workflows/build-image.yaml

@@ -9,10 +9,12 @@ on:
     - created
   schedule:
   - cron: 00 00 * * *
+  push:
 
 permissions:
-  contents: read
-  packages: write
+  contents: none
+  # contents: read  # To read Dockerfile and codebase
+  # packages: write  # To publish container image
 
 jobs:
   docker:

.github/workflows/ci-cd.yml

@@ -17,7 +17,8 @@ on:
   workflow_call:  # a way to embed the main tests
 
 permissions:
-  contents: read
+  contents: none
+  # contents: read #  To read codebase
 
 concurrency:
   group: >-

.github/workflows/pr-title.yml

@@ -9,6 +9,10 @@ on:
     - edited
     - synchronize
 
+permissions:
+  contents: none
+  # pull-requests: read  # To read the PR title
+
 jobs:
   main:
     name: Validate PR title

.github/workflows/pre-commit.yaml

@@ -4,6 +4,11 @@ name: Common issues check
 
 on: [pull_request]
 
+permissions:
+  contents: none
+  # contents: write  # Backpush pre-commit fixes
+
+
 jobs:
   pre-commit:
     runs-on: ubuntu-latest

.github/workflows/release.yml

@@ -14,6 +14,11 @@ on:
     - .pre-commit-hooks.yaml
     # Ignore paths
     - '!tests/**'
+
+permissions:
+  contents: none
+  # contents: write  # To create releases
+
 jobs:
   release:
     name: Release
@@ -34,4 +39,4 @@ jobs:
           @semantic-release/[email protected]
           @semantic-release/[email protected]
       env:
-        GITHUB_TOKEN: ${{ secrets.SEMANTIC_RELEASE_TOKEN }}
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/scheduled-runs.yml

@@ -10,6 +10,10 @@ on:
   - cron: 3 5 * * *  # run daily at 5:03 UTC
   workflow_dispatch:  # manual trigger
 
+permissions:
+  contents: none
+  # contents: read  # To read codebase
+
 run-name: >-
   🌃
   Nightly run of

.github/workflows/stale-actions.yaml

@@ -5,6 +5,12 @@ on:
   schedule:
   - cron: 0 0 * * *
 
+permissions:
+  contents: none
+  # contents: write  # To delete branches.
+  # issues: write  # To mark and close stale issues.
+  # pull-requests: write  # To mark and close stale pull requests.
+
 jobs:
   stale:
     runs-on: ubuntu-latest