search

linuxwacom / xf86-input-wacom

X.Org driver for Wacom devices
356 stars 45 forks source link

github: Minimize permissions granted to automated workflows / jobs #328

Closed jigpu closed 8 months ago

jigpu commented 8 months ago

Jobs that use the GITHUB_TOKEN to perform sensitive actions on behalf of a real user may be granted a range of permissions. Instead of granting blanket permissions to read and write "all" APIs, we should really limit the permissions what any individual workflow or job can do.

This commit sets the default permissions for each workflow to "contents: read", which allows jobs to only read from the repository.

Link: https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idpermissions

whot commented 8 months ago

Merging despite the (unrelated) CI failure which is addressed in #329, thanks!