From 13539bd8c651e56e7abfc7f8bd471dc44e4b5e36 Mon Sep 17 00:00:00 2001 From: Alex Date: Fri, 23 Sep 2022 22:14:16 +0200 Subject: [PATCH 1/2] build: harden codeql-analysis.yml permissions Signed-off-by: Alex --- .github/workflows/codeql-analysis.yml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index 7442be92b..14732684d 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -9,9 +9,16 @@ on: schedule: - cron: '0 22 * * 5' +permissions: + contents: read # to fetch code (actions/checkout) + jobs: CodeQL-Build: + permissions: + contents: read # to fetch code (actions/checkout) + security-events: write # to upload SARIF results (github/codeql-action/analyze) + runs-on: ubuntu-latest steps: From 5c82f4beca302b80cc84a66e5a7206861a63bee4 Mon Sep 17 00:00:00 2001 From: Alex Date: Fri, 23 Sep 2022 22:14:57 +0200 Subject: [PATCH 2/2] build: harden ci.yml permissions Signed-off-by: Alex --- .github/workflows/ci.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index a98d7e032..54bc2afb6 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -6,6 +6,9 @@ env: LC_ALL: en_US.UTF-8 LANG: en_US.UTF-8 +permissions: + contents: read # to fetch code (actions/checkout) + jobs: linux: name: Linux (python=${{ matrix.pyver }} cc=${{ matrix.cc }} sanitize=${{ matrix.sanitize }})