From 091917a4a1ef1b5f57ea1fd96034cd13dcf6c68d Mon Sep 17 00:00:00 2001 From: Alex Date: Mon, 19 Sep 2022 17:51:59 +0200 Subject: [PATCH] build: harden GitHub Workflow permissions Signed-off-by: Alex Low --- .github/workflows/publish-release-artifacts.yml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.github/workflows/publish-release-artifacts.yml b/.github/workflows/publish-release-artifacts.yml index a87a75efa..fb9c3ec14 100644 --- a/.github/workflows/publish-release-artifacts.yml +++ b/.github/workflows/publish-release-artifacts.yml @@ -5,8 +5,15 @@ on: types: - published +permissions: + contents: read + jobs: publish-release-artifacts: + permissions: + contents: read # to fetch code (actions/checkout) + actions: write # to attach binaries to release artifacts (skx/github-action-publish-binaries) + runs-on: ubuntu-latest if: startsWith(github.ref, 'refs/tags/') -- 2.47.2