[StepSecurity] Apply security best practices (#678)

resolve: #677 Signed-off-by: StepSecurity Bot <bot@stepsecurity.io> Co-authored-by: Scott M Stark <starksm64@gmail.com>
jakartaee · Nov 30, 2023 · d9e8656 · d9e8656
1 parent 38265cb
commit d9e8656
Show file tree

Hide file tree

Showing 2 changed files with 19 additions and 0 deletions.
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
@@ -0,0 +1,16 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: daily
+
+  - package-ecosystem: bundler
+    directory: /docs
+    schedule:
+      interval: daily
+
+  - package-ecosystem: maven
+    directory: /
+    schedule:
+      interval: daily
diff --git a/.github/workflows/ci-actions.yml b/.github/workflows/ci-actions.yml
@@ -4,6 +4,9 @@ on:
   pull_request:
     branches: [ main ]
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: "Build CDI - JDK ${{matrix.java}}"