From ae163ade7ba9d4f052eb92d7f21eadcde98f18ca Mon Sep 17 00:00:00 2001 From: Sebastiaan van Stijn Date: Fri, 9 Jan 2026 09:28:23 +0100 Subject: [PATCH] gha: set "read" permissions as default Signed-off-by: Sebastiaan van Stijn --- .github/workflows/build.yml | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index ec74c5a..9a4ac0a 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -1,5 +1,14 @@ name: build +# Default to 'contents: read', which grants actions to read commits. +# +# If any permission is set, any permission not included in the list is +# implicitly set to "none". +# +# see https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions +permissions: + contents: read + concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true @@ -136,6 +145,9 @@ jobs: build: runs-on: ubuntu-24.04 + permissions: + # required to create GitHub release + contents: write steps: - name: Checkout