Update GitHub Actions security (#28)

* Pin GitHub Actions to SHA * Add permissions to reusable workflows
stacklok · Jan 10, 2025 · 66384d3 · 66384d3
1 parent 1fc70c5
commit 66384d3
Show file tree

Hide file tree

Showing 3 changed files with 6 additions and 1 deletion.
diff --git a/.github/workflows/_security-checks.yaml b/.github/workflows/_security-checks.yaml
@@ -3,6 +3,9 @@ name: Security checks
 on:
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   trivy:
     name: Trivy scan

diff --git a/.github/workflows/_static-checks.yaml b/.github/workflows/_static-checks.yaml
@@ -3,6 +3,9 @@ name: Static checks
 on:
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   lint:
     name: Lint and format checks

diff --git a/.github/workflows/on-pr.yaml b/.github/workflows/on-pr.yaml
@@ -14,4 +14,3 @@ jobs:
   static-checks:
     name: Static checks
     uses: ./.github/workflows/_static-checks.yaml
-    secrets: inherit