From fa9eae34507d42441c25c0ed5dc90061495e781e Mon Sep 17 00:00:00 2001 From: "Ch.-David Blot" Date: Wed, 27 May 2026 12:56:39 +0200 Subject: [PATCH] =?UTF-8?q?=F0=9F=94=92=EF=B8=8F=20ci:=20add=20explicit=20?= =?UTF-8?q?least-privilege=20permissions=20to=20all=20workflows?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .github/workflows/cred-scan.yml | 3 +++ .github/workflows/github-sanity-scan.yml | 3 +++ .github/workflows/release-osc-api.yml | 3 +++ 3 files changed, 9 insertions(+) diff --git a/.github/workflows/cred-scan.yml b/.github/workflows/cred-scan.yml index a2cec71..42d06d1 100644 --- a/.github/workflows/cred-scan.yml +++ b/.github/workflows/cred-scan.yml @@ -4,6 +4,9 @@ on: pull_request: branches: [ master ] +permissions: + contents: read + jobs: cred-scan: runs-on: ubuntu-latest diff --git a/.github/workflows/github-sanity-scan.yml b/.github/workflows/github-sanity-scan.yml index 9e830ed..709617e 100644 --- a/.github/workflows/github-sanity-scan.yml +++ b/.github/workflows/github-sanity-scan.yml @@ -4,6 +4,9 @@ on: pull_request: branches: [ master ] +permissions: + contents: read + jobs: github-sanity-scan: runs-on: ubuntu-latest diff --git a/.github/workflows/release-osc-api.yml b/.github/workflows/release-osc-api.yml index 47279df..2c66770 100644 --- a/.github/workflows/release-osc-api.yml +++ b/.github/workflows/release-osc-api.yml @@ -3,6 +3,9 @@ on: release: types: [released] +permissions: + contents: read + jobs: osc-api-deploy: runs-on: ubuntu-latest