ci/permissions: Restrict permissions for remaining workflows (#31603)

Signed-off-by: Ryan Northey <ryan@synca.io>
envoyproxy · Jan 3, 2024 · f812033 · f812033
1 parent 0684847
commit f812033
Show file tree

Hide file tree

Showing 3 changed files with 15 additions and 0 deletions.
diff --git a/.github/workflows/codeql-daily.yml b/.github/workflows/codeql-daily.yml
@@ -1,3 +1,8 @@
+name: CodeQL/daily
+
+permissions:
+  contents: read
+
 on:
   schedule:
   - cron: '0 12 * * 4'
@@ -6,11 +11,13 @@ concurrency:
   group: ${{ github.head_ref-github.workflow || github.run_id }}
   cancel-in-progress: true
 
+
 jobs:
   CodeQL-Build:
 
     permissions:
       security-events: write  # for github/codeql-action/analyze to upload SARIF results
+      pull-requests: read
     strategy:
       fail-fast: false
 

diff --git a/.github/workflows/codeql-push.yml b/.github/workflows/codeql-push.yml
@@ -1,5 +1,8 @@
 name: CodeQL
 
+permissions:
+  contents: read
+
 on:
   push:
     paths:
@@ -12,11 +15,13 @@ concurrency:
   group: ${{ github.head_ref-github.workflow || github.run_id }}
   cancel-in-progress: true
 
+
 jobs:
   CodeQL-Build:
 
     permissions:
       security-events: write  # for github/codeql-action/analyze to upload SARIF results
+      pull-requests: read
     strategy:
       fail-fast: false
 

diff --git a/.github/workflows/envoy-sync.yml b/.github/workflows/envoy-sync.yml
@@ -1,5 +1,8 @@
 name: 'Sync downstream'
 
+permissions:
+  contents: read
+
 on:
   push:
     branches: