From 50ba86cd8eefa60e3595a9995d17855396907291 Mon Sep 17 00:00:00 2001 From: Varun Sharma Date: Sat, 29 Apr 2023 22:27:25 -0700 Subject: [PATCH] Update code-review.yml --- .github/workflows/code-review.yml | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/.github/workflows/code-review.yml b/.github/workflows/code-review.yml index c8e20696..286a9f6e 100644 --- a/.github/workflows/code-review.yml +++ b/.github/workflows/code-review.yml @@ -4,20 +4,23 @@ on: branches: - main - int +permissions: + contents: read + jobs: code-review: - name: int tests + name: Code Review runs-on: ubuntu-latest permissions: contents: read pull-requests: write steps: - name: Harden Runner - uses: step-security/harden-runner@6b3083af2869dc3314a0257a42f4af696cc79ba3 + uses: step-security/harden-runner@6b3083af2869dc3314a0257a42f4af696cc79ba3 # v2.3.1 with: - egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs + egress-policy: audit - name: Code Review - uses: docker://ghcr.io/step-security/code-reviewer/int:latest # docker pull ghcr.io/step-security/code-reviewer/int:latest + uses: docker://ghcr.io/step-security/code-reviewer/int:latest env: PAT: ${{ secrets.GITHUB_TOKEN }}