CI: Fix missing explicit permissions for workflow runs

Signed-off-by: Heathcliff <[email protected]>
heathcliff26 · Jan 4, 2025 · 90eef39 · 90eef39
1 parent a5a4d71
commit 90eef39
Show file tree

Hide file tree

Showing 6 changed files with 14 additions and 0 deletions.
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
@@ -19,14 +19,20 @@ on:
 jobs:
   lint:
     uses: heathcliff26/ci/.github/workflows/golang-lint.yaml@main
+    permissions:
+      contents: read
 
   unit-tests:
     uses: heathcliff26/ci/.github/workflows/golang-unit-tests.yaml@main
+    permissions:
+      contents: read
     with:
       coveralls: ${{ github.event_name == 'pull_request' || github.event_name == 'merge_group' }}
 
   validate:
     uses: heathcliff26/ci/.github/workflows/golang-build.yaml@main
+    permissions:
+      contents: read
     with:
       cache: false
       cmd: "make validate"
diff --git a/.github/workflows/editorconfig-check.yaml b/.github/workflows/editorconfig-check.yaml
@@ -13,3 +13,5 @@ on:
 jobs:
   check-editorconfig:
     uses: heathcliff26/ci/.github/workflows/editorconfig-check.yaml@main
+    permissions:
+      contents: read
diff --git a/.github/workflows/go-testcover-report.yaml b/.github/workflows/go-testcover-report.yaml
@@ -10,5 +10,6 @@ jobs:
   generate-reports:
     uses: heathcliff26/ci/.github/workflows/golang-testcover-report.yaml@main
     secrets: inherit
+    permissions: {}
     with:
       coveralls: true
diff --git a/.github/workflows/link-check.yaml b/.github/workflows/link-check.yaml
@@ -10,5 +10,6 @@ jobs:
   check-links:
     uses: heathcliff26/ci/.github/workflows/link-check.yaml@main
     secrets: inherit
+    permissions: {}
     with:
       exclude-paths: "vendor"
diff --git a/.github/workflows/renovate-config-validator.yaml b/.github/workflows/renovate-config-validator.yaml
@@ -20,3 +20,5 @@ on:
 jobs:
   validate-renovate-config:
     uses: heathcliff26/ci/.github/workflows/renovate-config-validator.yaml@main
+    permissions:
+      contents: read
diff --git a/.github/workflows/renovate.yaml b/.github/workflows/renovate.yaml
@@ -27,6 +27,7 @@ env:
 jobs:
   prepare:
     runs-on: ubuntu-latest
+    permissions: {}
     outputs:
       dry-run: ${{ steps.config.outputs.dry-run }}
       log-level: "${{ steps.config.outputs.log-level }}"
@@ -40,6 +41,7 @@ jobs:
   renovate:
     needs: prepare
     uses: heathcliff26/ci/.github/workflows/renovate.yaml@main
+    permissions: {}
     with:
       dry-run: ${{ needs.prepare.outputs.dry-run }}
       log-level: "${{ needs.prepare.outputs.log-level }}"