make GitHub workflow permissions explicit

stretchr · Jan 3, 2025 · d2a3dac · d2a3dac
1 parent 7c367bb
commit d2a3dac
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 0 deletions.
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
@@ -1,6 +1,10 @@
 name: All builds
 on: [push, pull_request]
 
+permissions:
+  contents: read
+  packages: read
+
 jobs:
   build:
     runs-on: ubuntu-latest

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -1,5 +1,9 @@
 name: Create release from new tag
 
+# setting default permissions to "none"
+# because permissions are set at the job level
+permissions: {}
+
 # this flow will be run only when new tags are pushed that match our pattern
 on:
   push: