From e66fe8534e81b6199dbb4dfdacaf3e5b8ba4210b Mon Sep 17 00:00:00 2001 From: Alex Date: Sat, 5 Nov 2022 15:21:55 +0200 Subject: [PATCH] GitHub Workflows security hardening (#14799) * build: harden update_frontend.yml permissions Signed-off-by: Alex * build: harden update_zhc.yml permissions Signed-off-by: Alex * build: harden ghcr_cleanup.yml permissions Signed-off-by: Alex * build: harden update_zh.yml permissions Signed-off-by: Alex Signed-off-by: Alex --- .github/workflows/ghcr_cleanup.yml | 1 + .github/workflows/update_frontend.yml | 5 +++++ .github/workflows/update_zh.yml | 5 +++++ .github/workflows/update_zhc.yml | 5 +++++ 4 files changed, 16 insertions(+) diff --git a/.github/workflows/ghcr_cleanup.yml b/.github/workflows/ghcr_cleanup.yml index 1e7075b3..ccb296e1 100644 --- a/.github/workflows/ghcr_cleanup.yml +++ b/.github/workflows/ghcr_cleanup.yml @@ -3,6 +3,7 @@ on: name: GHCR cleanup +permissions: {} jobs: build: runs-on: ubuntu-latest diff --git a/.github/workflows/update_frontend.yml b/.github/workflows/update_frontend.yml index 1382d386..45131836 100644 --- a/.github/workflows/update_frontend.yml +++ b/.github/workflows/update_frontend.yml @@ -3,8 +3,13 @@ on: repository_dispatch: types: update_frontend +permissions: {} jobs: update_frontend: + permissions: + contents: write # to create branch (peter-evans/create-pull-request) + pull-requests: write # to create a PR (peter-evans/create-pull-request) + runs-on: ubuntu-latest steps: - uses: actions/checkout@v3 diff --git a/.github/workflows/update_zh.yml b/.github/workflows/update_zh.yml index 92aaa05e..bba3ec2a 100644 --- a/.github/workflows/update_zh.yml +++ b/.github/workflows/update_zh.yml @@ -3,8 +3,13 @@ on: repository_dispatch: types: update_zh +permissions: {} jobs: update_zh: + permissions: + contents: write # to create branch (peter-evans/create-pull-request) + pull-requests: write # to create a PR (peter-evans/create-pull-request) + runs-on: ubuntu-latest steps: - uses: actions/checkout@v3 diff --git a/.github/workflows/update_zhc.yml b/.github/workflows/update_zhc.yml index 7df5e88c..a75cb1f7 100644 --- a/.github/workflows/update_zhc.yml +++ b/.github/workflows/update_zhc.yml @@ -3,8 +3,13 @@ on: repository_dispatch: types: update_zhc +permissions: {} jobs: update_zhc: + permissions: + contents: write # to create branch (peter-evans/create-pull-request) + pull-requests: write # to create a PR (peter-evans/create-pull-request) + runs-on: ubuntu-latest steps: - uses: actions/checkout@v3