build: harden cibuild.yml permissions

Signed-off-by: Alex <aleksandrosansan@gmail.com>

diff --git a/.github/workflows/cibuild.yml b/.github/workflows/cibuild.yml
index 811537cc8820d4c24f75fba1617d76da3812106b..dc10ad4c41736b78c61374f52c249e3356902e74 100644 (file)
--- a/.github/workflows/cibuild.yml
+++ b/.github/workflows/cibuild.yml
@@ -14,6 +14,9 @@ on:
       - 'Documentation/**'
       - 'lib*/docs/**'
 
+permissions:
+  contents: read # to fetch code (actions/checkout)
+
 jobs:
   build:
     runs-on: ubuntu-latest
@@ -38,6 +41,10 @@ jobs:
       - name: Make install
         run: .github/workflows/cibuild.sh INSTALL
   coveralls:
+    permissions:
+      contents: read # to fetch code (actions/checkout)
+      checks: write # to create new checks (coverallsapp/github-action)
+
     runs-on: ubuntu-latest
     if: github.repository == 'util-linux/util-linux'
     env: