ci: set contents read as default workflow permissions

crazy-max · Feb 8, 2025 · dbfee65 · dbfee65
1 parent 9880ce2
commit dbfee65
Show file tree

Hide file tree

Showing 3 changed files with 32 additions and 2 deletions.
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
@@ -1,9 +1,13 @@
 name: build
 
 concurrency:
-  group: build-${{ github.ref }}
+  group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
+permissions:
+  contents: read
+
 on:
   push:
     branches:
@@ -29,6 +33,12 @@ env:
 
 jobs:
   build:
+    runs-on: ubuntu-latest
+    permissions:
+      # required to create GitHub release
+      contents: write
+      # required to push to GHCR
+      packages: write
     strategy:
       fail-fast: false
       matrix:
@@ -40,7 +50,6 @@ jobs:
           - '3.20'
           - '3.21'
           - 'edge'
-    runs-on: ubuntu-latest
     steps:
       -
         name: Checkout

diff --git a/.github/workflows/labels.yml b/.github/workflows/labels.yml
@@ -1,5 +1,13 @@
 name: labels
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
+permissions:
+  contents: read
+
 on:
   push:
     branches:
@@ -15,6 +23,11 @@ on:
 jobs:
   labeler:
     runs-on: ubuntu-latest
+    permissions:
+      # same as global permissions
+      contents: read
+      # required to update labels
+      issues: write
     steps:
       -
         name: Checkout

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
@@ -1,5 +1,13 @@
 name: test
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
+permissions:
+  contents: read
+
 on:
   push:
     branches: