diff options
| author | neilnaveen <42328488+neilnaveen@users.noreply.github.com> | 2022-06-05 01:08:15 +0000 |
|---|---|---|
| committer | Samuel Williams <samuel.williams@oriontransfer.co.nz> | 2022-06-05 13:35:58 +1200 |
| commit | 38a113a58ea1a7f9557f1f1f4629daa3fe83122c (patch) | |
| tree | 8f6c4d111353828109131ffeafb25303400eabb9 | |
| parent | 40081eb47caca09ad8ae320f85c0b0bfa8b9838f (diff) | |
| download | rack-38a113a58ea1a7f9557f1f1f4629daa3fe83122c.tar.gz | |
chore: Set permissions for GitHub actions
Restrict the GitHub token permissions only to the required ones; this way, even if the attackers will succeed in compromising your workflow, they won’t be able to do much.
- Included permissions for the action. https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions
https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
https://docs.github.com/en/actions/using-jobs/assigning-permissions-to-jobs
[Keeping your GitHub Actions and workflows secure Part 1: Preventing pwn requests](https://securitylab.github.com/research/github-actions-preventing-pwn-requests/)
Signed-off-by: neilnaveen <42328488+neilnaveen@users.noreply.github.com>
| -rw-r--r-- | .github/workflows/development.yml | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/.github/workflows/development.yml b/.github/workflows/development.yml index 885c5901..92dacb24 100644 --- a/.github/workflows/development.yml +++ b/.github/workflows/development.yml @@ -2,6 +2,9 @@ name: Development on: [push, pull_request] +permissions: + contents: read + jobs: test: strategy: |