]> git.ipfire.org Git - thirdparty/openssl.git/commitdiff
ci: add GitHub token permissions for workflows
authorVarun Sharma <varunsh@stepsecurity.io>
Sat, 9 Jul 2022 14:03:23 +0000 (07:03 -0700)
committerPauli <pauli@openssl.org>
Wed, 13 Jul 2022 00:14:09 +0000 (10:14 +1000)
Signed-off-by: Varun Sharma <varunsh@stepsecurity.io>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/18766)

15 files changed:
.github/workflows/ci.yml
.github/workflows/compiler-zoo.yml
.github/workflows/coveralls.yml
.github/workflows/cross-compiles.yml
.github/workflows/fips-checksums.yml
.github/workflows/fips-label.yml
.github/workflows/fips-provider.yml
.github/workflows/fuzz-checker.yml
.github/workflows/main.yml
.github/workflows/os-zoo.yml
.github/workflows/run-checker-ci.yml
.github/workflows/run-checker-daily.yml
.github/workflows/run-checker-merge.yml
.github/workflows/static-analysis.yml
.github/workflows/windows.yml

index d2094c74bef2515f01e0a72f8430a192cc14b361..843ed480cd1579fb96b5d279912f7d370c6e3463 100644 (file)
@@ -18,6 +18,9 @@ on: [pull_request, push]
 # before_script:
 #     - make="make -s"
 
+permissions:
+  contents: read
+
 jobs:
   check_update:
     runs-on: ubuntu-latest
index 59f316a63e594906e5b38dc88321ca50f843be07..a8525258c5af066f8701d7d46f657b11d0f4981f 100644 (file)
@@ -9,6 +9,9 @@ name: Compiler Zoo CI
 
 on: [push]
 
+permissions:
+  contents: read
+
 jobs:
   compiler:
     strategy:
index c23df85acf82362dbae357fa654f117c7436d20b..ec1367d829587a2c98e6d3641048fb793f3032b2 100644 (file)
@@ -12,8 +12,14 @@ on:
   schedule:
     - cron:  '49 0 * * *'
 
+permissions:
+  contents: read
+
 jobs:
   coverage:
+    permissions:
+      checks: write  # for coverallsapp/github-action to create new checks
+      contents: read  # for actions/checkout to fetch code
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v2
index b77c41f17e2aab7235e1d10a0ac4b90ce22ffbf6..0b4609e57ee9a717162856ed374d82fd14525de8 100644 (file)
@@ -9,6 +9,9 @@ name: Cross Compile
 
 on: [pull_request, push]
 
+permissions:
+  contents: read
+
 jobs:
   cross-compilation:
     strategy:
index 78351981d51c3638e5a40e11c2126c1d23d82483..176b3dea3068449a1c7f22ef8a7df5d30d9e9ad1 100644 (file)
@@ -8,6 +8,9 @@
 name: FIPS Checksums
 on: [pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   compute-checksums:
     runs-on: ubuntu-latest
index c241801b9ec17fe220a34df307fc54e832d42144..a22e9bf0692db8f961344cc051d3f25c69b1380d 100644 (file)
@@ -12,8 +12,14 @@ on:
     types:
       - completed
 
+permissions:
+  contents: read
+
 jobs:
   apply-label:
+    permissions:
+      actions: read
+      pull-requests: write
     runs-on: ubuntu-latest
     if: ${{ github.event.workflow_run.event == 'pull_request' }}
     steps:
index 18af712b62ba55e3132593dff538d8c9659d5291..69dea41811df9b08e239233acfc72b6621ebdc8a 100644 (file)
@@ -8,6 +8,9 @@
 name: Provider compat
 on: [push]
 
+permissions:
+  contents: read
+
 jobs:
   fips-provider-30:
     runs-on: ubuntu-latest
index 4d3bf35884791f506a0ff67caf65ce305f9e96dd..9e5627fd03190b489808e5095b0ee63d0f345be5 100644 (file)
@@ -9,6 +9,9 @@ name: Fuzz-checker CI
 
 on: [push]
 
+permissions:
+  contents: read
+
 jobs:
   fuzz-checker:
     strategy:
index 4ad9c0c1fab151b4f393b546053438f88b49e1ba..0646e5e713a652587b302489c3e1cf1a5a5cfdca 100644 (file)
@@ -7,6 +7,9 @@
 
 name: CIFuzz
 on: [pull_request, push]
+permissions:
+  contents: read
+
 jobs:
   Fuzzing:
     runs-on: ubuntu-latest
index 3e05b803d861c3c9f750be1ce172cdd5bd8994e8..429cd1eb89090f4c850786205b0afba2adb5d7e9 100644 (file)
@@ -11,6 +11,9 @@ on:
   schedule:
     - cron: '0 5 * * *'
 
+permissions:
+  contents: read
+
 jobs:
   unix:
     strategy:
index 1fa716f94ab80d8f0be5f1112baac61761fe5bb6..cfc458ac583cc6fc89e3584c542918cbb1d56d58 100644 (file)
@@ -8,6 +8,9 @@
 # Jobs run per pull request submission
 name: Run-checker CI
 on: [pull_request, push]
+permissions:
+  contents: read
+
 jobs:
   run-checker:
     strategy:
index 923b5aa6703ab83b40bdb7e2b716698eb2a1bba1..da5105c8f35884471bd6a4eca6e457bb479f4170 100644 (file)
@@ -11,6 +11,9 @@ name: Run-checker daily
 on:
   schedule:
     - cron: '0 6 * * *'
+permissions:
+  contents: read
+
 jobs:
   run-checker:
     strategy:
index 7795ab1db25671af51f30be1a20efa0a1c732dd3..dcc9d0d15f56bae330e29a135dcf10fd36174d65 100644 (file)
@@ -9,6 +9,9 @@ name: Run-checker merge
 # Jobs run per merge to master
 
 on: [push]
+permissions:
+  contents: read
+
 jobs:
   run-checker:
     strategy:
index 6c69436c1754d877ff2e8288e75f05580346cc4a..119733c7d2581de240888493e71a81f6af0e44b3 100644 (file)
@@ -12,6 +12,9 @@ on:
   schedule:
     - cron:  '20 0 * * *'
 
+permissions:
+  contents: read
+
 jobs:
   coverity:
     runs-on: ubuntu-latest
index c530ba07801ad96600107fa3a5282e03dcbcdb4c..92052cf49b98d2f4377b06bfc7bdb9c0a513ad90 100644 (file)
@@ -9,6 +9,9 @@ name: Windows GitHub CI
 
 on: [pull_request, push]
 
+permissions:
+  contents: read
+
 jobs:
   shared:
     # Run a job for each of the specified target architectures: