Restrict permissions for GITHUB_TOKEN in our workflows

Added using https://github.com/step-security/secure-workflows
For more information see:
- https://github.com/ossf/scorecard/blob/d8fefc9b246db3600c777e9d60d441d7c386ce1d/docs/checks.md#token-permissions
- https://github.blog/changelog/2021-04-20-github-actions-control-permissions-for-github_token/

diff --git a/.github/workflows/build-and-test-all.yml b/.github/workflows/build-and-test-all.yml
index 2965ec12be5a5cdcfd0b69776d9cda7157fd4f97..3c90ed7d2cbbda9c9493fec4a40b17666adb2856 100644 (file)
--- a/.github/workflows/build-and-test-all.yml
+++ b/.github/workflows/build-and-test-all.yml
@@ -7,6 +7,9 @@ on:
   schedule:
     - cron: '0 22 * * 3'
 
+permissions: # least privileges, see https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
+  contents: read
+
 jobs:
   build-auth:
     name: build auth

diff --git a/.github/workflows/builder-dispatch.yml b/.github/workflows/builder-dispatch.yml
index fed8e9647c0406d64bb1ce8c5a57b0e2be5f253a..b8122e89c254e90bf73ff458666b7c36459a032f 100644 (file)
--- a/.github/workflows/builder-dispatch.yml
+++ b/.github/workflows/builder-dispatch.yml
@@ -34,6 +34,9 @@ on:
         - 'NO'
         - 'YES'
 
+permissions: # least privileges, see https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
+  contents: read
+
 jobs:
   prepare:
     name: generate OS list

diff --git a/.github/workflows/builder.yml b/.github/workflows/builder.yml
index b1a3e8116aa7e1c8c0e24bd044013b13965248c9..3807d5e30b5e2ea77572ceec5a21f804ebff7e0e 100644 (file)
--- a/.github/workflows/builder.yml
+++ b/.github/workflows/builder.yml
@@ -5,6 +5,9 @@ on:
   schedule:
     - cron: '0 1 * * *'
 
+permissions: # least privileges, see https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
+  contents: read
+
 jobs:
   build:
     name: build.sh

diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 6bd284604087a2ef7ba9b71022a6a250b57b1ba1..f74ce90486d29636957113816e10e3b4f9dc845c 100644 (file)
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -6,11 +6,19 @@ on:
   schedule:
     - cron: '0 22 * * 2'
 
+permissions: # least privileges, see https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
+  contents: read
+
 jobs:
   analyze:
     name: Analyze
     runs-on: ubuntu-20.04
 
+    permissions:
+      actions: read # for github/codeql-action/init to get workflow details
+      contents: read  # for actions/checkout to fetch code
+      security-events: write  # for github/codeql-action/analyze to upload SARIF results
+
     strategy:
       fail-fast: false
       matrix:

diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index d36ca3e8ad7855374bdaf4df0ceddf5883727edd..98551c18a0936a7efd9b5dd8f529c3b1379ec845 100644 (file)
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -5,6 +5,9 @@ on:
   schedule:
     - cron: '0 4 * * *'
 
+permissions: # least privileges, see https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
+  contents: read
+
 jobs:
   build:
     name: docker build

diff --git a/.github/workflows/formatting.yml b/.github/workflows/formatting.yml
index 2b71e0a0983e8455a046ab0265d8466ac22e5012..852239281e8294b01b9db0112f0556e351a78b79 100644 (file)
--- a/.github/workflows/formatting.yml
+++ b/.github/workflows/formatting.yml
@@ -5,6 +5,9 @@ on:
   push:
   pull_request:
 
+permissions: # least privileges, see https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
+  contents: read
+
 jobs:
   build:
     name: verify formatting and Makefile.am sort order

diff --git a/.github/workflows/fuzz.yml b/.github/workflows/fuzz.yml
index 2fc954a5db2d29c1a6a2b0ecbdec75957e0ada91..c93ed0ef8769374afd8658ede15b5e582a0bbd92 100644 (file)
--- a/.github/workflows/fuzz.yml
+++ b/.github/workflows/fuzz.yml
@@ -1,5 +1,9 @@
 name: CIFuzz
 on: [pull_request]
+
+permissions: # least privileges, see https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
+  contents: read
+
 jobs:
   Fuzzing:
     runs-on: ubuntu-20.04

diff --git a/.github/workflows/misc-dailies.yml b/.github/workflows/misc-dailies.yml
index 04771121c44f779ee77c235fcede35d4893a35a7..8159e831cb4a1c371629cdb92a92bba5486a408d 100644 (file)
--- a/.github/workflows/misc-dailies.yml
+++ b/.github/workflows/misc-dailies.yml
@@ -4,6 +4,9 @@ on:
   schedule:
     - cron: '34 4 * * *'
 
+permissions: # least privileges, see https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
+  contents: read
+
 jobs:
   el7-devtoolset:
     runs-on: ubuntu-22.04

diff --git a/.github/workflows/secpoll.yml b/.github/workflows/secpoll.yml
index c5ee41de904af7ce96dd0499695b233107ec0804..be08e63e6cb3819c071a89c4affe760cdd0cbf12 100644 (file)
--- a/.github/workflows/secpoll.yml
+++ b/.github/workflows/secpoll.yml
@@ -5,6 +5,9 @@ on:
   push:
   pull_request:
 
+permissions: # least privileges, see https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
+  contents: read
+
 jobs:
   build:
     name: check secpoll zone

diff --git a/.github/workflows/spelling.yml b/.github/workflows/spelling.yml
index 7cf39614917a33a79262a2499de716fa56bc4e9a..c250cd1046a13d2a0effd1e88fd12b8b3d959063 100644 (file)
--- a/.github/workflows/spelling.yml
+++ b/.github/workflows/spelling.yml
@@ -4,6 +4,9 @@ on:
   push:
     branches: ''
 
+permissions: # least privileges, see https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
+  contents: read
+
 jobs:
   placeholder:
     name: Should be disabled