Merge pull request #1617 from mandiant/fix/issue-1616

ci: restrict permissions of GITHUB_TOKEN
mandiant · Jul 10, 2023 · aa80552 · aa80552
2 parents 1373fab + 454b6d1
commit aa80552
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 0 deletions.
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
@@ -1,5 +1,8 @@
 name: build
 
+permissions:
+  contents: write
+
 on:
   pull_request:
     branches: [ master ]

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
@@ -2,6 +2,9 @@
 # https://blog.trailofbits.com/2023/05/23/trusted-publishing-a-new-benchmark-for-packaging-security/
 name: publish to pypi
 
+permissions:
+  contents: write
+
 on:
   release:
     types: [published]