Tighten GITHUB_TOKEN permissions

Signed-off-by: Michael Telatynski <[email protected]>
matrix-org · Nov 20, 2024 · a282cb8 · a282cb8
1 parent d75fa1d
commit a282cb8
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 0 deletions.
diff --git a/.github/workflows/sonarcloud.yml b/.github/workflows/sonarcloud.yml
@@ -21,6 +21,7 @@ jobs:
             github.event.workflow_run.conclusion == 'success' &&
             github.event.workflow_run.event != 'merge_group'
         permissions:
+            actions: read
             statuses: write
             id-token: write # sonar
         steps:

diff --git a/.github/workflows/sonarqube.yml b/.github/workflows/sonarqube.yml
@@ -13,6 +13,7 @@ jobs:
         name: 🩻 SonarQube
         if: github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event != 'merge_group'
         permissions:
+            actions: read
             statuses: write
             id-token: write # sonar
         uses: matrix-org/matrix-js-sdk/.github/workflows/sonarcloud.yml@develop