From 298c6c1bd66ad1d26e3ce6233d9f090d67bbda8e Mon Sep 17 00:00:00 2001 From: Alex Date: Tue, 20 Sep 2022 12:46:19 +0200 Subject: [PATCH 1/2] build: harden filter_testsuite.yml permissions Signed-off-by: Alex --- .github/workflows/filter_testsuite.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.github/workflows/filter_testsuite.yml b/.github/workflows/filter_testsuite.yml index 27f4c350885..b19254ad78e 100644 --- a/.github/workflows/filter_testsuite.yml +++ b/.github/workflows/filter_testsuite.yml @@ -4,8 +4,13 @@ on: issue_comment: types: [created] +permissions: {} jobs: build: + permissions: + pull-requests: read + issues: write # to create comment + if: (github.event.comment.user.login == 'sloriot' || github.event.comment.user.login == 'lrineau') && contains(github.event.comment.body, '/testme') runs-on: ubuntu-latest steps: From 845caa5ee72e53a06b09472028366bb2820fcc9c Mon Sep 17 00:00:00 2001 From: Alex Date: Tue, 20 Sep 2022 12:47:49 +0200 Subject: [PATCH 2/2] build: harden build_doc.yml permissions Signed-off-by: Alex --- .github/workflows/build_doc.yml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.github/workflows/build_doc.yml b/.github/workflows/build_doc.yml index 8a238305b81..d1d6fb4828f 100644 --- a/.github/workflows/build_doc.yml +++ b/.github/workflows/build_doc.yml @@ -4,9 +4,16 @@ on: issue_comment: types: [created] +permissions: + contents: read # to fetch code (actions/checkout) + jobs: build: + permissions: + contents: read # to fetch code (actions/checkout) + issues: write # to create comment + runs-on: ubuntu-latest steps: - uses: actions/github-script@v6