mirror of
https://github.com/spf13/cobra
synced 2024-11-13 01:07:20 +00:00
ci: add minimum GitHub token permissions for workflows (#1792)
Signed-off-by: Varun Sharma <varunsh@stepsecurity.io>
This commit is contained in:
parent
93d1913fb0
commit
23fc5e099f
4 changed files with 23 additions and 0 deletions
6
.github/workflows/labeler.yml
vendored
6
.github/workflows/labeler.yml
vendored
|
@ -2,8 +2,14 @@ name: "Pull Request Labeler"
|
|||
on:
|
||||
- pull_request_target
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
jobs:
|
||||
triage:
|
||||
permissions:
|
||||
contents: read # for actions/labeler to determine modified files
|
||||
pull-requests: write # for actions/labeler to add labels to PRs
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/labeler@v4
|
||||
|
|
5
.github/workflows/size-labeler.yml
vendored
5
.github/workflows/size-labeler.yml
vendored
|
@ -4,8 +4,13 @@ name: size-labeler
|
|||
|
||||
on: [pull_request_target]
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
jobs:
|
||||
size-labeler:
|
||||
permissions:
|
||||
pull-requests: write # for codelytv/pr-size-labeler to add labels & comment on PRs
|
||||
runs-on: ubuntu-latest
|
||||
name: Label the PR size
|
||||
steps:
|
||||
|
|
6
.github/workflows/stale.yml
vendored
6
.github/workflows/stale.yml
vendored
|
@ -4,9 +4,15 @@ on:
|
|||
schedule:
|
||||
- cron: "0 0 * * *"
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
jobs:
|
||||
stale:
|
||||
|
||||
permissions:
|
||||
issues: write # for actions/stale to close stale issues
|
||||
pull-requests: write # for actions/stale to close stale PRs
|
||||
runs-on: ubuntu-latest
|
||||
|
||||
steps:
|
||||
|
|
6
.github/workflows/test.yml
vendored
6
.github/workflows/test.yml
vendored
|
@ -8,6 +8,9 @@ on:
|
|||
env:
|
||||
GO111MODULE: on
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
jobs:
|
||||
|
||||
|
||||
|
@ -30,6 +33,9 @@ jobs:
|
|||
|
||||
|
||||
golangci-lint:
|
||||
permissions:
|
||||
contents: read # for actions/checkout to fetch code
|
||||
pull-requests: read # for golangci/golangci-lint-action to fetch pull requests
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
|
||||
|
|
Loading…
Reference in a new issue