Merge pull request #3084 from sashashura/patch-1

GitHub Workflows security hardening
PHPOffice · Dec 12, 2023 · 5aaed9e · 5aaed9e
2 parents 689f961 + da0269d
commit 5aaed9e
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 0 deletions.
diff --git a/.github/workflows/github-pages.yml b/.github/workflows/github-pages.yml
@@ -4,8 +4,12 @@ on:
     tags:
       - '*'
 
+permissions: {}
 jobs:
   github-pages:
+    permissions:
+      contents: write # to push pages branch (peaceiris/actions-gh-pages)
+
     runs-on: ubuntu-latest
     steps:
       - name: Checkout

diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
@@ -1,5 +1,7 @@
 name: main
 on: [ push, pull_request, merge_group ]
+permissions:
+  contents: read # to fetch code (actions/checkout)
 jobs:
   test:
     runs-on: ubuntu-latest
@@ -241,6 +243,8 @@ jobs:
           ~/.composer/vendor/bin/ocular code-coverage:upload --format=php-clover coverage-clover.xml
 
   release:
+    permissions:
+      contents: write # to create a release (actions/create-release)
     runs-on: ubuntu-latest
     if: github.event_name == 'push' && contains(github.ref, 'refs/tags/')
     steps: