From: Emil Velikov <emil.l.velikov@gmail.com>
Date: Fri, 16 Aug 2024 15:41:28 +0000 (+0100)
Subject: ci: use read-only workflow tokens
X-Git-Tag: v34~503
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=b931ba271bba4fda387e3ed0b5a4ee60623f3309;p=thirdparty%2Fkmod.git

ci: use read-only workflow tokens

Seemingly the defaults are write-all, which means the action can push
pages, accept PRs and others.

This is another suggestion I've seen by the GOSST folks.

Signed-off-by: Emil Velikov <emil.l.velikov@gmail.com>
Link: https://github.com/kmod-project/kmod/pull/76
Signed-off-by: Lucas De Marchi <lucas.de.marchi@gmail.com>
---

diff --git a/.github/workflows/codespell.yml b/.github/workflows/codespell.yml
index 16856663..0ef74864 100644
--- a/.github/workflows/codespell.yml
+++ b/.github/workflows/codespell.yml
@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: [master]
 
+permissions:
+  contents: read
+
 jobs:
   spellcheck:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 056005c2..2d63660b 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: [master]
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest