Skip to content

Commit 97de5a1

Browse files
sthulbsthulb
committed
chore(ci): update permissions
1 parent b232265 commit 97de5a1

14 files changed

+63
-19
lines changed

‎.github/workflows/build-docs.yml

+3
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,9 @@ on:
1818
- 'mkdocs.yml'
1919
- 'Makefile'
2020

21+
permissions:
22+
contents: read
23+
2124
jobs:
2225
docs:
2326
runs-on: ubuntu-latest

‎.github/workflows/dispatch_analytics.yml

+13-12
Original file line numberDiff line numberDiff line change
@@ -7,22 +7,23 @@ on:
77
- cron: '0 * * * *'
88

99
permissions:
10-
id-token: write
11-
actions: read
12-
checks: read
1310
contents: read
14-
deployments: read
15-
issues: read
16-
discussions: read
17-
packages: read
18-
pages: read
19-
pull-requests: read
20-
repository-projects: read
21-
security-events: read
22-
statuses: read
2311

2412
jobs:
2513
dispatch_token:
14+
permissions:
15+
id-token: write
16+
actions: read
17+
checks: read
18+
deployments: read
19+
issues: read
20+
discussions: read
21+
packages: read
22+
pages: read
23+
pull-requests: read
24+
repository-projects: read
25+
security-events: read
26+
statuses: read
2627
concurrency:
2728
group: analytics
2829
runs-on: ubuntu-latest

‎.github/workflows/docs.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -7,14 +7,14 @@ on:
77
workflow_dispatch: {}
88

99
permissions:
10-
id-token: write
1110
contents: write
12-
pages: write
1311

1412
jobs:
1513
docs:
1614
runs-on: ubuntu-latest
1715
environment: Docs
16+
permissions:
17+
id-token: write
1818
steps:
1919
- uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
2020
- name: Set up Python

‎.github/workflows/pr_artifacts_size.yml

+4
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,10 @@ on:
2323
- 'powertools-validation/**'
2424
- 'pom.xml'
2525
- '.github/workflows/pr_artifacts_size.yml'
26+
27+
permissions:
28+
contents: read
29+
2630
jobs:
2731
codecheck:
2832
runs-on: ubuntu-latest

‎.github/workflows/pr_build.yml

+4-1
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,10 @@ on:
4545
- 'pom.xml'
4646
- 'examples/pom.xml'
4747
- '.github/workflows/**'
48+
49+
permissions:
50+
contents: read
51+
4852
jobs:
4953
build-corretto:
5054
runs-on: ubuntu-latest
@@ -58,7 +62,6 @@ jobs:
5862
AWS_REGION: eu-west-1
5963
permissions:
6064
id-token: write # needed to interact with GitHub's OIDC Token endpoint.
61-
contents: read
6265
steps:
6366
- uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
6467
- name: Setup java

‎.github/workflows/pr_build_v2.yml

+4-1
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,10 @@ on:
4141
- 'pom.xml'
4242
- 'examples/pom.xml'
4343
- '.github/workflows/**'
44+
45+
permissions:
46+
contents: read
47+
4448
jobs:
4549
build-corretto:
4650
runs-on: ubuntu-latest
@@ -54,7 +58,6 @@ jobs:
5458
AWS_REGION: eu-west-1
5559
permissions:
5660
id-token: write # needed to interact with GitHub's OIDC Token endpoint.
57-
contents: read
5861
steps:
5962
- uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
6063
- name: Setup java

‎.github/workflows/pr_iac_lint.yml

+4
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,10 @@ on:
1111
- v2
1212
paths:
1313
- 'examples/**'
14+
15+
permissions:
16+
contents: read
17+
1418
jobs:
1519
linter:
1620
runs-on: ubuntu-latest

‎.github/workflows/publish.yml

+6
Original file line numberDiff line numberDiff line change
@@ -4,9 +4,15 @@ on:
44
types:
55
- published
66
workflow_dispatch: {}
7+
8+
permissions:
9+
contents: read
10+
711
jobs:
812
publish:
913
runs-on: ubuntu-latest
14+
permissions:
15+
id-token: write
1016
steps:
1117
- uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
1218
- name: Set up Maven Central Repository

‎.github/workflows/release-drafter.yml

+5
Original file line numberDiff line numberDiff line change
@@ -6,9 +6,14 @@ on:
66
branches:
77
- main
88

9+
permissions:
10+
contents: read
11+
912
jobs:
1013
update_release_draft:
1114
runs-on: ubuntu-latest
15+
permissions:
16+
id-token: write
1217
steps:
1318
- uses: release-drafter/release-drafter@569eb7ee3a85817ab916c8f8ff03a5bd96c9c83e # v5.23.0
1419
env:

‎.github/workflows/release-prep.yml

+5
Original file line numberDiff line numberDiff line change
@@ -6,9 +6,14 @@ on:
66
description: 'Release number to upgrade to. For example X.X.X. Follow Semantic Versioning when deciding on next version.'
77
required: true
88

9+
permissions:
10+
contents: read
11+
912
jobs:
1013
build:
1114
runs-on: ubuntu-latest
15+
permissions:
16+
id-token: write
1217
steps:
1318
- uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
1419
- name: Get current date

‎.github/workflows/run-e2e-tests-v2.yml

+3
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,9 @@ on:
2727
paths:
2828
- 'powertools-e2e-tests/**'
2929

30+
permissions:
31+
contents: read
32+
3033
jobs:
3134
e2e:
3235
runs-on: ubuntu-latest

‎.github/workflows/run-e2e-tests.yml

+3-1
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,9 @@ on:
2727
paths:
2828
- 'powertools-e2e-tests/**'
2929

30+
permissions:
31+
contents: read
32+
3033
jobs:
3134
e2e:
3235
runs-on: ubuntu-latest
@@ -40,7 +43,6 @@ jobs:
4043
JAVA_VERSION: ${{ matrix.java }}
4144
permissions:
4245
id-token: write # needed to interact with GitHub's OIDC Token endpoint.
43-
contents: read
4446
steps:
4547
- uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
4648
- name: Setup java

‎.github/workflows/secure_workflows.yml

+3-2
Original file line numberDiff line numberDiff line change
@@ -19,12 +19,13 @@ on:
1919
paths:
2020
- ".github/workflows/**"
2121

22+
permissions:
23+
contents: read
24+
2225
jobs:
2326
enforce_pinned_workflows:
2427
name: Harden Security
2528
runs-on: ubuntu-latest
26-
permissions:
27-
contents: read # checkout code and subsequently GitHub action workflows
2829
steps:
2930
- name: Checkout code
3031
uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3

‎.github/workflows/spotbugs.yml

+4
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,10 @@ on:
1919
- 'powertools-test-suite/**'
2020
- 'pom.xml'
2121
- '.github/workflows/**'
22+
23+
permissions:
24+
contents: read
25+
2226
jobs:
2327
codecheck:
2428
runs-on: ubuntu-latest

0 commit comments

Comments
 (0)