CI: GitHub Workflows security hardening (#3377)

Signed-off-by: Alex <aleksandrosansan@gmail.com>
lovell · Sep 26, 2022 · 32a22b5 · 32a22b5
1 parent d1004ee
commit 32a22b5
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 0 deletions.
diff --git a/.github/workflows/ci-darwin-arm64v8.yml b/.github/workflows/ci-darwin-arm64v8.yml
@@ -2,8 +2,11 @@ name: CI (MacStadium)
 on:
   - push
   - pull_request
+permissions: {}
 jobs:
   CI:
+    permissions:
+      contents: write # for npx prebuild to make release
     runs-on: macos-m1
     strategy:
       fail-fast: false

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -2,8 +2,13 @@ name: CI (GitHub)
 on:
   - push
   - pull_request
+permissions: {}
 jobs:
   CI:
+    permissions:
+      contents: write # for npx prebuild to make release
+      checks: write # to create new checks (coverallsapp/github-action)
+
     runs-on: ${{ matrix.os }}
     container: ${{ matrix.container }}
     strategy: