Add explicit GITHUB_TOKEN permissions for each workflow

reichlab · Feb 28, 2025 · a6f0223 · a6f0223
1 parent b4667c5
commit a6f0223
Show file tree

Hide file tree

Showing 3 changed files with 6 additions and 0 deletions.
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
@@ -6,6 +6,8 @@ on:
       - main
   pull_request:
   workflow_dispatch:
+permissions:
+  contents: read
 
 env:
   FORCE_COLOR: "1"

diff --git a/.github/workflows/publish-pypi-test.yaml b/.github/workflows/publish-pypi-test.yaml
@@ -7,6 +7,8 @@ on:
   push:
     branches:
       - main
+permissions:
+  contents: read
 
 jobs:
   build:

diff --git a/.github/workflows/publish-pypi.yaml b/.github/workflows/publish-pypi.yaml
@@ -9,6 +9,8 @@ on:
     tags:
       # only run workflow for tags in release format
       - "v[0-9]+.[0-9]+.[0-9]+"
+permissions:
+  contents: read
 
 jobs:
   build:
-Original file line number
+Diff line change
@@ Expand Up / @@ -7,6 +7,8 @@ on: @@
       push:
         branches:
           - main
+    permissions:
+      contents: read
     jobs:
       build:
@@ Expand Down @@