GitHub Workflows security hardening (#3519)

* build: harden tutorials.yml permissions Signed-off-by: Alex <[email protected]> * build: harden contrib.yml permissions Signed-off-by: Alex <[email protected]> * build: harden tests.yml permissions Signed-off-by: Alex <[email protected]>
nipy · Dec 1, 2022 · c3020e2 · c3020e2
1 parent 5d436ba
commit c3020e2
Show file tree

Hide file tree

Showing 3 changed files with 11 additions and 0 deletions.
diff --git a/.github/workflows/contrib.yml b/.github/workflows/contrib.yml
@@ -22,6 +22,9 @@ concurrency:
   group: contrib-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read # to fetch code (actions/checkout)
+
 jobs:
   stable:
     # Check each OS, all supported Python, minimum versions and latest releases

diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
@@ -29,8 +29,12 @@ concurrency:
   group: tests-${{ github.ref }}
   cancel-in-progress: true
 
+permissions: {}
 jobs:
   build:
+    permissions:
+      contents: read # to fetch code (actions/checkout)
+
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
@@ -80,6 +84,9 @@ jobs:
 
   stable:
     # Check each OS, all supported Python, minimum versions and latest releases
+    permissions:
+      contents: read # to fetch code (actions/checkout)
+
     runs-on: ${{ matrix.os }}
     strategy:
       matrix:

diff --git a/.github/workflows/tutorials.yml b/.github/workflows/tutorials.yml
@@ -9,6 +9,7 @@ concurrency:
   group: tutorials-${{ github.ref }}
   cancel-in-progress: true
 
+permissions: {}
 jobs:
   tutorial:
     runs-on: ubuntu-latest