Set minimal permissions for github actions workflows (#557)

ponylang · Jan 25, 2025 · 352c9f6 · 352c9f6
1 parent 6dd914c
commit 352c9f6
Show file tree

Hide file tree

Showing 5 changed files with 16 additions and 1 deletion.
diff --git a/.github/workflows/add-discuss-during-sync.yml b/.github/workflows/add-discuss-during-sync.yml
@@ -18,6 +18,9 @@ on:
     types:
       - submitted
 
+permissions:
+  pull-requests: write
+
 jobs:
   add-label:
     runs-on: ubuntu-latest

diff --git a/.github/workflows/lint-action-workflows.yml b/.github/workflows/lint-action-workflows.yml
@@ -6,6 +6,9 @@ concurrency:
   group: lint-actions-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  packages: read
+
 jobs:
   lint:
     name: Lint
@@ -14,6 +17,6 @@ jobs:
       - name: Checkout
         uses: actions/[email protected]
       - name: Check workflow files
-        uses: docker://ghcr.io/ponylang/shared-docker-ci-actionlint:20241206
+        uses: docker://ghcr.io/ponylang/shared-docker-ci-actionlint:20250119
         with:
           args: -color
diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
@@ -6,6 +6,9 @@ concurrency:
   group: pr-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  packages: read
+
 jobs:
   superlinter:
     name: Lint markdown and yaml

diff --git a/.github/workflows/remove-discuss-during-sync.yml b/.github/workflows/remove-discuss-during-sync.yml
@@ -8,6 +8,9 @@ on:
     types:
       - closed
 
+permissions:
+  pull-requests: write
+
 jobs:
   remove-label:
     runs-on: ubuntu-latest

diff --git a/.github/workflows/verify-site-builds.yml b/.github/workflows/verify-site-builds.yml
@@ -5,6 +5,9 @@ on:
   schedule:
     - cron: '0 2 * * *'
 
+permissions:
+  packages: read
+
 jobs:
   test:
     name: Verify site builds