Set GHA token permissions to be read-only

urllib3 · Jul 20, 2022 · 0a5f34d · 0a5f34d
1 parent ac61b73
commit 0a5f34d
Show file tree

Hide file tree

Showing 4 changed files with 7 additions and 0 deletions.
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -2,6 +2,8 @@ name: CI
 
 on: [push, pull_request]
 
+permissions: "read-all"
+
 defaults:
   run:
     shell: bash

diff --git a/.github/workflows/integration.yml b/.github/workflows/integration.yml
@@ -5,6 +5,8 @@ on:
     paths:
       - "src/urllib3/_version.py"
 
+permissions: "read-all"
+
 jobs:
   integration:
     strategy:

diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
@@ -2,6 +2,8 @@ name: lint
 
 on: [push, pull_request]
 
+permissions: "read-all"
+
 jobs:
   lint:
     runs-on: ubuntu-20.04

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
@@ -6,6 +6,7 @@ on:
       - "*"
 
 permissions:
+  contents: "read"
   # Needed to access the workflow's OIDC identity.
   id-token: "write"
-Original file line number
+Diff line change
@@ Expand Up / @@ -2,6 +2,8 @@ name: lint @@
     on: [push, pull_request]
+    permissions: "read-all"
     jobs:
       lint:
         runs-on: ubuntu-20.04
@@ Expand Down @@