Explicitly define permissions for CodeQL jobs (#570)

meziantou · Nov 6, 2023 · a384fcb · a384fcb
1 parent 9e6e8d9
commit a384fcb
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 0 deletions.
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -1,5 +1,6 @@
 name: publish
 on:
+  workflow_dispatch:
   push:
     branches:
       - 'main'

diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
@@ -12,6 +12,7 @@
 name: "CodeQL"
 
 on:
+  workflow_dispatch:  
   push:
     branches: [ main ]
   pull_request:
@@ -24,6 +25,11 @@ jobs:
   analyze:
     name: Analyze
     runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+      statuses: write      
 
     strategy:
       fail-fast: false