Set GHA token permissions to be read-only
MODIFY
.github/workflows/changelog.yml
.github/workflows/changelog.yml
@@ -4,6 +4,8 @@ on:
pull_request:
types: [labeled, unlabeled, opened, reopened, synchronize]
+permissions: "read-all"
+
jobs:
check-changelog-entry:
name: changelog entry

MODIFY
.github/workflows/ci.yml
.github/workflows/ci.yml
@@ -2,6 +2,8 @@ name: CI
on: [push, pull_request]
+permissions: "read-all"
+
defaults:
run:
shell: bash

MODIFY
.github/workflows/integration.yml
.github/workflows/integration.yml
@@ -2,6 +2,8 @@ name: Downstream
on: [push, pull_request]
+permissions: "read-all"
+
jobs:
integration:
strategy:

MODIFY
.github/workflows/lint.yml
.github/workflows/lint.yml
@@ -2,6 +2,8 @@ name: lint
on: [push, pull_request]
+permissions: "read-all"
+
jobs:
lint:
runs-on: ubuntu-20.04

MODIFY
.github/workflows/publish.yml
.github/workflows/publish.yml
@@ -6,6 +6,7 @@ on:
- "*"
permissions:
+ contents: "read"
# Needed to access the workflow's OIDC identity.
id-token: "write"

Set GHA token permissions to be read-only