ci: add least-privilege read-only token permissions (#455)
Add a top-level `permissions: { contents: read }` block to the 22
GitHub Actions workflows that lacked one, so the automatic GITHUB_TOKEN
is granted only read access to repository contents by default.
No workflow behaviour changes.diff --git a/.github/workflows/aarch64_linux_bazel.yml b/.github/workflows/aarch64_linux_bazel.yml
index 25f8715..fedfd95 100644
--- a/.github/workflows/aarch64_linux_bazel.yml
+++ b/.github/workflows/aarch64_linux_bazel.yml
@@ -7,6 +7,9 @@
# min hours day(month) month day(week)
- cron: '0 0 7,22 * *'
+permissions:
+ contents: read
+
jobs:
# Building using the GitHub runner environement directly.
bazel:
diff --git a/.github/workflows/aarch64_linux_cmake.yml b/.github/workflows/aarch64_linux_cmake.yml
index 5bd422b..7872b7e 100644
--- a/.github/workflows/aarch64_linux_cmake.yml
+++ b/.github/workflows/aarch64_linux_cmake.yml
@@ -7,6 +7,9 @@
# min hours day(month) month day(week)
- cron: '0 0 7,22 * *'
+permissions:
+ contents: read
+
jobs:
# Building using the github runner environement directly.
make:
diff --git a/.github/workflows/aarch64_linux_zig.yml b/.github/workflows/aarch64_linux_zig.yml
index e1e59d5..e673e3d 100644
--- a/.github/workflows/aarch64_linux_zig.yml
+++ b/.github/workflows/aarch64_linux_zig.yml
@@ -2,6 +2,9 @@
on: [push, pull_request]
+permissions:
+ contents: read
+
jobs:
run:
strategy:
diff --git a/.github/workflows/amd64_linux_bazel.yml b/.github/workflows/amd64_linux_bazel.yml
index 4ed4e85..a156f8a 100644
--- a/.github/workflows/amd64_linux_bazel.yml
+++ b/.github/workflows/amd64_linux_bazel.yml
@@ -7,6 +7,9 @@
# min hours day(month) month day(week)
- cron: '0 0 7,22 * *'
+permissions:
+ contents: read
+
jobs:
# Building using the github runner environement directly.
bazel:
diff --git a/.github/workflows/amd64_linux_cmake.yml b/.github/workflows/amd64_linux_cmake.yml
index eed4d01..5b30054 100644
--- a/.github/workflows/amd64_linux_cmake.yml
+++ b/.github/workflows/amd64_linux_cmake.yml
@@ -7,6 +7,9 @@
# min hours day(month) month day(week)
- cron: '0 0 7,22 * *'
+permissions:
+ contents: read
+
jobs:
# Building using the github runner environement directly.
make:
diff --git a/.github/workflows/amd64_linux_zig.yml b/.github/workflows/amd64_linux_zig.yml
index bf99754..b2eb946 100644
--- a/.github/workflows/amd64_linux_zig.yml
+++ b/.github/workflows/amd64_linux_zig.yml
@@ -2,6 +2,9 @@
on: [push, pull_request]
+permissions:
+ contents: read
+
jobs:
run:
strategy:
diff --git a/.github/workflows/amd64_macos_bazel.yml b/.github/workflows/amd64_macos_bazel.yml
index e5c2a80..5e835b4 100644
--- a/.github/workflows/amd64_macos_bazel.yml
+++ b/.github/workflows/amd64_macos_bazel.yml
@@ -8,6 +8,9 @@
# min hours day(month) month day(week)
- cron: '0 0 7,22 * *'
+permissions:
+ contents: read
+
jobs:
# Building using the github runner environement directly.
bazel:
diff --git a/.github/workflows/amd64_macos_cmake.yml b/.github/workflows/amd64_macos_cmake.yml
index d95dc08..b0f5003 100644
--- a/.github/workflows/amd64_macos_cmake.yml
+++ b/.github/workflows/amd64_macos_cmake.yml
@@ -8,6 +8,9 @@
# min hours day(month) month day(week)
- cron: '0 0 7,22 * *'
+permissions:
+ contents: read
+
jobs:
# Building using the github runner environement directly.
xcode:
diff --git a/.github/workflows/amd64_macos_zig.yml b/.github/workflows/amd64_macos_zig.yml
index 4fde639..eeb6468 100644
--- a/.github/workflows/amd64_macos_zig.yml
+++ b/.github/workflows/amd64_macos_zig.yml
@@ -2,6 +2,9 @@
on: [push, pull_request]
+permissions:
+ contents: read
+
jobs:
run:
strategy:
diff --git a/.github/workflows/amd64_windows_bazel.yml b/.github/workflows/amd64_windows_bazel.yml
index d61cf79..7f269fb 100644
--- a/.github/workflows/amd64_windows_bazel.yml
+++ b/.github/workflows/amd64_windows_bazel.yml
@@ -8,6 +8,9 @@
# min hours day(month) month day(week)
- cron: '0 0 7,22 * *'
+permissions:
+ contents: read
+
jobs:
# Building using the github runner environement directly.
bazel:
diff --git a/.github/workflows/amd64_windows_cmake.yml b/.github/workflows/amd64_windows_cmake.yml
index 176d7c0..a4d67c3 100644
--- a/.github/workflows/amd64_windows_cmake.yml
+++ b/.github/workflows/amd64_windows_cmake.yml
@@ -7,6 +7,9 @@
# min hours day(month) month day(week)
- cron: '0 0 7,22 * *'
+permissions:
+ contents: read
+
jobs:
# Building using the github runner environement directly.
msvc:
diff --git a/.github/workflows/amd64_windows_zig.yml b/.github/workflows/amd64_windows_zig.yml
index d1f835a..6ce634a 100644
--- a/.github/workflows/amd64_windows_zig.yml
+++ b/.github/workflows/amd64_windows_zig.yml
@@ -2,6 +2,9 @@
on: [push, pull_request]
+permissions:
+ contents: read
+
jobs:
run:
strategy:
diff --git a/.github/workflows/arm64_macos_bazel.yml b/.github/workflows/arm64_macos_bazel.yml
index 01bc284..0f7d282 100644
--- a/.github/workflows/arm64_macos_bazel.yml
+++ b/.github/workflows/arm64_macos_bazel.yml
@@ -8,6 +8,9 @@
# min hours day(month) month day(week)
- cron: '0 0 7,22 * *'
+permissions:
+ contents: read
+
jobs:
# Building using the github runner environement directly.
bazel:
diff --git a/.github/workflows/arm64_macos_cmake.yml b/.github/workflows/arm64_macos_cmake.yml
index 749c18a..55267fc 100644
--- a/.github/workflows/arm64_macos_cmake.yml
+++ b/.github/workflows/arm64_macos_cmake.yml
@@ -8,6 +8,9 @@
# min hours day(month) month day(week)
- cron: '0 0 7,22 * *'
+permissions:
+ contents: read
+
jobs:
# Building using the github runner environement directly.
xcode:
diff --git a/.github/workflows/arm64_macos_zig.yml b/.github/workflows/arm64_macos_zig.yml
index d6bb0f4..a51d26f 100644
--- a/.github/workflows/arm64_macos_zig.yml
+++ b/.github/workflows/arm64_macos_zig.yml
@@ -2,6 +2,9 @@
on: [push, pull_request]
+permissions:
+ contents: read
+
jobs:
run:
strategy:
diff --git a/.github/workflows/arm_linux_cmake.yml b/.github/workflows/arm_linux_cmake.yml
index 3430401..0a061dd 100644
--- a/.github/workflows/arm_linux_cmake.yml
+++ b/.github/workflows/arm_linux_cmake.yml
@@ -7,6 +7,9 @@
# min hours day(month) month day(week)
- cron: '0 0 7,22 * *'
+permissions:
+ contents: read
+
jobs:
# Building using the github runner environement directly.
make:
diff --git a/.github/workflows/clang_format.yml b/.github/workflows/clang_format.yml
index c87fab2..5cb43fc 100644
--- a/.github/workflows/clang_format.yml
+++ b/.github/workflows/clang_format.yml
@@ -2,6 +2,9 @@
on: [push, pull_request]
+permissions:
+ contents: read
+
jobs:
# Building using the github runner environement directly.
clang-format:
diff --git a/.github/workflows/mips_linux_cmake.yml b/.github/workflows/mips_linux_cmake.yml
index f6d7d95..82964e0 100644
--- a/.github/workflows/mips_linux_cmake.yml
+++ b/.github/workflows/mips_linux_cmake.yml
@@ -7,6 +7,9 @@
# min hours day(month) month day(week)
- cron: '0 0 7,22 * *'
+permissions:
+ contents: read
+
jobs:
# Building using the github runner environement directly.
make:
diff --git a/.github/workflows/power_linux_cmake.yml b/.github/workflows/power_linux_cmake.yml
index 211c9c5..8c329d1 100644
--- a/.github/workflows/power_linux_cmake.yml
+++ b/.github/workflows/power_linux_cmake.yml
@@ -7,6 +7,9 @@
# min hours day(month) month day(week)
- cron: '0 0 7,22 * *'
+permissions:
+ contents: read
+
jobs:
# Building using the github runner environement directly.
make:
diff --git a/.github/workflows/riscv_linux_cmake.yml b/.github/workflows/riscv_linux_cmake.yml
index 89a8ad5..6cc0a27 100644
--- a/.github/workflows/riscv_linux_cmake.yml
+++ b/.github/workflows/riscv_linux_cmake.yml
@@ -7,6 +7,9 @@
# min hours day(month) month day(week)
- cron: '0 0 7,22 * *'
+permissions:
+ contents: read
+
jobs:
# Building using the github runner environement directly.
make:
diff --git a/.github/workflows/s390x_linux_cmake.yml b/.github/workflows/s390x_linux_cmake.yml
index 788768d..fb31b98 100644
--- a/.github/workflows/s390x_linux_cmake.yml
+++ b/.github/workflows/s390x_linux_cmake.yml
@@ -7,6 +7,9 @@
# min hours day(month) month day(week)
- cron: '0 0 7,22 * *'
+permissions:
+ contents: read
+
jobs:
# Building using the github runner environement directly.
make:
diff --git a/.github/workflows/zig.yml b/.github/workflows/zig.yml
index c8298e7..61efb30 100644
--- a/.github/workflows/zig.yml
+++ b/.github/workflows/zig.yml
@@ -2,6 +2,9 @@
on: [push, pull_request]
+permissions:
+ contents: read
+
jobs:
zig-fmt:
runs-on: ubuntu-latest
