ci:harden permissions for all github workflows

Signed-off-by: Carl Zhang <[email protected]>
intel · Feb 8, 2024 · 393799a · 393799a
1 parent a438699
commit 393799a
Show file tree

Hide file tree

Showing 6 changed files with 18 additions and 0 deletions.
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
@@ -1,5 +1,8 @@
 name: docs
 
+permissions:
+  contents: read
+
 on:
   push:
     paths-ignore:

diff --git a/.github/workflows/freebsd.yml b/.github/workflows/freebsd.yml
@@ -1,5 +1,8 @@
 name: freebsd
 
+permissions:
+  contents: read
+
 on: [push, pull_request]
 
 jobs:

diff --git a/.github/workflows/ghpages.yml b/.github/workflows/ghpages.yml
@@ -1,5 +1,8 @@
 name: Deploy Docs to GitHub
 
+permissions:
+  contents: read
+
 on:
   release:
     types: [published]

diff --git a/.github/workflows/style.yml b/.github/workflows/style.yml
@@ -1,5 +1,8 @@
 name: style
 
+permissions:
+  contents: read
+
 on: [push, pull_request]
 
 jobs:

diff --git a/.github/workflows/ubuntu.yml b/.github/workflows/ubuntu.yml
@@ -1,5 +1,8 @@
 name: ubuntu
 
+permissions:
+  contents: read
+
 on: [push, pull_request]
 
 env:

diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml
@@ -1,5 +1,8 @@
 name: windows
 
+permissions:
+  contents: read
+
 on: [push, pull_request]
 
 jobs: