build: harden cifuzz.yml permissions

Signed-off-by: Alex <aleksandrosansan@gmail.com>

diff --git a/.github/workflows/cifuzz.yml b/.github/workflows/cifuzz.yml
index 93ebc3ceaa0af9baea0b7f979e5f0ba6b08618c4..e4945c06a225031698c6c5ed944f163ccb29ebb4 100644 (file)
--- a/.github/workflows/cifuzz.yml
+++ b/.github/workflows/cifuzz.yml
@@ -12,8 +12,15 @@ on:
       - master
     paths:
       - '**'
+permissions:
+  contents: read # to clone the repo (google/oss-fuzz/infra/cifuzz/actions/run_fuzzers)
+
 jobs:
   Fuzzing:
+    permissions:
+      actions: read # to fetch the artifacts (google/oss-fuzz/infra/cifuzz/actions/run_fuzzers)
+      contents: read # to clone the repo (google/oss-fuzz/infra/cifuzz/actions/run_fuzzers)
+
     runs-on: ubuntu-latest
     if: github.repository == 'util-linux/util-linux'
     strategy: