workflows: limit permissions to reading repo contents
authorBenjamin Gilbert <bgilbert@redhat.com>
Wed, 28 Jul 2021 22:32:04 +0000 (18:32 -0400)
committerBenjamin Gilbert <bgilbert@redhat.com>
Wed, 28 Jul 2021 22:32:04 +0000 (18:32 -0400)
Move the existing docs permissions stanza to the top of the workflow for
consistency.

.github/workflows/docs.yml
.github/workflows/release.yml
.github/workflows/rust.yml
.github/workflows/tests.yml

index 05ede2e97340e390a82a87acfdd877c5c6e7295c..74f5e9d6c9dfe664c01c14fbe1a962cc6a30dea6 100644 (file)
@@ -1,19 +1,21 @@
 ---
 name: Docs
+
 on:
   push:
     branches: [main]
   pull_request:
     branches: [main]
 
+permissions:
+  # This workflow pushes to the gh-pages branch, so the token needs write
+  # privileges for repo contents.
+  contents: write
+
 jobs:
   docs:
     name: Build documentation
     runs-on: ubuntu-latest
-    permissions:
-      # This job pushes to the gh-pages branch, so the token needs write
-      # privileges for repo contents.
-      contents: write
     steps:
       - name: Checkout repository
         uses: actions/checkout@v2
index 399b6637186d9549b075aa896dddad8bcad4d0e2..e8fcd42bd4f2b87f0378ab37319266694cd44fec 100644 (file)
@@ -7,6 +7,9 @@ on:
     paths:
       - 'configure.ac'
 
+permissions:
+  contents: read
+
 jobs:
   ci-release-build:
     name: "Sanity check release commits"
index 0dce242a8a47ca6e1731496af9116a2039e1f648..ef6e38a7341388459fe3f8eaf1cbb7b07c8f9be3 100644 (file)
@@ -1,11 +1,15 @@
 ---
 name: Rust
+
 on:
   push:
     branches: [main]
   pull_request:
     branches: [main]
 
+permissions:
+  contents: read
+
 env:
   CARGO_TERM_COLOR: always
   ACTIONS_LINTS_TOOLCHAIN: 1.53.0
index 45626be251fc2d08cb2521112692aae55561014b..df1b1e07e7e6c508bb019040cf87e74871ba40f2 100644 (file)
@@ -1,11 +1,15 @@
 ---
 name: Tests
+
 on:
   push:
     branches: [main]
   pull_request:
     branches: [main]
 
+permissions:
+  contents: read
+
 jobs:
   tests:
     # Distro configuration matrix