ci: use read-only workflow tokens

Seemingly the defaults are write-all, which means the action can push
pages, accept PRs and others.

This is another suggestion I've seen by the GOSST folks.

Signed-off-by: Emil Velikov <emil.l.velikov@gmail.com>
Link: https://github.com/kmod-project/kmod/pull/76
Signed-off-by: Lucas De Marchi <lucas.de.marchi@gmail.com>

diff --git a/.github/workflows/codespell.yml b/.github/workflows/codespell.yml
index 16856663d8e51cec74db57fd7685f799fd2ca662..0ef74864fc1dc0b446bd90b7c3f3d02a722f961e 100644 (file)
--- a/.github/workflows/codespell.yml
+++ b/.github/workflows/codespell.yml
@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: [master]
 
+permissions:
+  contents: read
+
 jobs:
   spellcheck:
     runs-on: ubuntu-latest

diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 056005c28d9386133a6b83983f2c1d6292aee524..2d63660b8aa0180069e5bc01e2df31b04bda1bf7 100644 (file)
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: [master]
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest