From 8b818e0c6af7b41d00a19a07040f0ce3224cd3ba Mon Sep 17 00:00:00 2001 From: Zen Dodd Date: Sat, 15 Aug 2026 17:15:49 +1000 Subject: [PATCH] ci: restrict workflow permissions --- .github/workflows/almalinux-8-build.yml | 3 +++ .github/workflows/android-static-build.yml | 3 +++ .github/workflows/asan-build.yml | 3 +++ .github/workflows/coverage.yml | 3 +++ .github/workflows/cygwin-build.yml | 3 +++ .github/workflows/fleettest.yml | 3 +++ .github/workflows/freebsd-build.yml | 3 +++ .github/workflows/macos-build.yml | 3 +++ .github/workflows/netbsd-build.yml | 3 +++ .github/workflows/openbsd-build.yml | 3 +++ .github/workflows/scan-build.yml | 3 +++ .github/workflows/solaris-build.yml | 3 +++ .github/workflows/ubuntu-build.yml | 3 +++ .github/workflows/ubuntu-version-mix.yml | 3 +++ .github/workflows/valgrind.yml | 3 +++ 15 files changed, 45 insertions(+) diff --git a/.github/workflows/almalinux-8-build.yml b/.github/workflows/almalinux-8-build.yml index 8eb4598c..98d2bf88 100644 --- a/.github/workflows/almalinux-8-build.yml +++ b/.github/workflows/almalinux-8-build.yml @@ -24,6 +24,9 @@ on: schedule: - cron: '42 8 * * *' +permissions: + contents: read + jobs: test: runs-on: ubuntu-latest diff --git a/.github/workflows/android-static-build.yml b/.github/workflows/android-static-build.yml index 14593a6d..dd26f509 100644 --- a/.github/workflows/android-static-build.yml +++ b/.github/workflows/android-static-build.yml @@ -28,6 +28,9 @@ on: - cron: '42 8 * * 1' workflow_dispatch: +permissions: + contents: read + env: # Minimum supported API level. 24 (Android 7.0) runs on every modern # phone while keeping broad reach; bump if you need newer Bionic APIs. diff --git a/.github/workflows/asan-build.yml b/.github/workflows/asan-build.yml index 246a31f9..10acbe7c 100644 --- a/.github/workflows/asan-build.yml +++ b/.github/workflows/asan-build.yml @@ -23,6 +23,9 @@ on: - cron: '42 9 * * 1' workflow_dispatch: +permissions: + contents: read + jobs: asan: runs-on: ubuntu-latest diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml index 6e0eccaf..23725f36 100644 --- a/.github/workflows/coverage.yml +++ b/.github/workflows/coverage.yml @@ -19,6 +19,9 @@ on: - cron: '42 9 * * 1' workflow_dispatch: +permissions: + contents: read + jobs: coverage: runs-on: ubuntu-latest diff --git a/.github/workflows/cygwin-build.yml b/.github/workflows/cygwin-build.yml index b82e18b1..0b62a731 100644 --- a/.github/workflows/cygwin-build.yml +++ b/.github/workflows/cygwin-build.yml @@ -18,6 +18,9 @@ on: schedule: - cron: '42 8 * * *' +permissions: + contents: read + jobs: test: runs-on: windows-2022 diff --git a/.github/workflows/fleettest.yml b/.github/workflows/fleettest.yml index 40f6f8fc..a782b87a 100644 --- a/.github/workflows/fleettest.yml +++ b/.github/workflows/fleettest.yml @@ -31,6 +31,9 @@ on: schedule: - cron: '17 7 * * 1' +permissions: + contents: read + jobs: fleettest: runs-on: ubuntu-latest diff --git a/.github/workflows/freebsd-build.yml b/.github/workflows/freebsd-build.yml index fe87913f..b446ad1e 100644 --- a/.github/workflows/freebsd-build.yml +++ b/.github/workflows/freebsd-build.yml @@ -18,6 +18,9 @@ on: schedule: - cron: '42 8 * * 1' +permissions: + contents: read + jobs: test: runs-on: ubuntu-latest diff --git a/.github/workflows/macos-build.yml b/.github/workflows/macos-build.yml index b20638a8..ca3e514e 100644 --- a/.github/workflows/macos-build.yml +++ b/.github/workflows/macos-build.yml @@ -18,6 +18,9 @@ on: schedule: - cron: '42 8 * * *' +permissions: + contents: read + jobs: test: runs-on: macos-latest diff --git a/.github/workflows/netbsd-build.yml b/.github/workflows/netbsd-build.yml index 4d2463b7..8525c70c 100644 --- a/.github/workflows/netbsd-build.yml +++ b/.github/workflows/netbsd-build.yml @@ -18,6 +18,9 @@ on: schedule: - cron: '42 8 * * 1' +permissions: + contents: read + jobs: test: runs-on: ubuntu-latest diff --git a/.github/workflows/openbsd-build.yml b/.github/workflows/openbsd-build.yml index 6218b9a2..9d594bb5 100644 --- a/.github/workflows/openbsd-build.yml +++ b/.github/workflows/openbsd-build.yml @@ -18,6 +18,9 @@ on: schedule: - cron: '42 8 * * 1' +permissions: + contents: read + jobs: test: runs-on: ubuntu-latest diff --git a/.github/workflows/scan-build.yml b/.github/workflows/scan-build.yml index 6aafaa12..033935f2 100644 --- a/.github/workflows/scan-build.yml +++ b/.github/workflows/scan-build.yml @@ -17,6 +17,9 @@ on: - '!.github/workflows/scan-build.yml' workflow_dispatch: +permissions: + contents: read + jobs: # GATING run: pinned clang-18 on a pinned runner so the checker set -- and # thus the expected zero -- is deterministic. The tree is kept clean for diff --git a/.github/workflows/solaris-build.yml b/.github/workflows/solaris-build.yml index 1b328e4a..fcdab467 100644 --- a/.github/workflows/solaris-build.yml +++ b/.github/workflows/solaris-build.yml @@ -18,6 +18,9 @@ on: schedule: - cron: '42 8 * * 1' +permissions: + contents: read + jobs: test: runs-on: ubuntu-latest diff --git a/.github/workflows/ubuntu-build.yml b/.github/workflows/ubuntu-build.yml index 30c1ccee..762ac9ef 100644 --- a/.github/workflows/ubuntu-build.yml +++ b/.github/workflows/ubuntu-build.yml @@ -18,6 +18,9 @@ on: schedule: - cron: '42 8 * * 1' +permissions: + contents: read + jobs: test: strategy: diff --git a/.github/workflows/ubuntu-version-mix.yml b/.github/workflows/ubuntu-version-mix.yml index d16dd09d..6eae8576 100644 --- a/.github/workflows/ubuntu-version-mix.yml +++ b/.github/workflows/ubuntu-version-mix.yml @@ -39,6 +39,9 @@ on: schedule: - cron: '52 8 * * 1' +permissions: + contents: read + jobs: version-mix: runs-on: ubuntu-latest diff --git a/.github/workflows/valgrind.yml b/.github/workflows/valgrind.yml index 33be5f10..2c22bb8d 100644 --- a/.github/workflows/valgrind.yml +++ b/.github/workflows/valgrind.yml @@ -19,6 +19,9 @@ on: - cron: '17 4 * * *' workflow_dispatch: +permissions: + contents: read + jobs: memcheck: runs-on: ubuntu-latest