From 3bb9c9c10a620a7e851fda6520f3a1e0ccb4f3a6 Mon Sep 17 00:00:00 2001 From: Jason Ross Date: Thu, 16 Oct 2025 14:12:33 -0500 Subject: [PATCH] updated permissions for workflows --- .github/workflows/release.yml | 6 ++++++ .github/workflows/status-checks.yml | 12 ++++++++++++ 2 files changed, 18 insertions(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index ba82405..5ead486 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -474,6 +474,9 @@ jobs: build-debian: needs: [verify-main-status-checks] if: ${{ contains(github.event.inputs.jobs, 'build-debian') }} + permissions: + contents: read + packages: read env: DISTRO_TYPE: debian runs-on: ubuntu-latest @@ -555,6 +558,9 @@ jobs: build-arch: needs: [verify-main-status-checks] if: ${{ contains(github.event.inputs.jobs, 'build-arch') }} + permissions: + contents: read + packages: read env: DISTRO_TYPE: arch runs-on: ubuntu-latest diff --git a/.github/workflows/status-checks.yml b/.github/workflows/status-checks.yml index deb09a9..b4d9179 100644 --- a/.github/workflows/status-checks.yml +++ b/.github/workflows/status-checks.yml @@ -18,6 +18,9 @@ env: jobs: run-unit-tests-debian: runs-on: ubuntu-latest + permissions: + contents: read + packages: read container: image: ghcr.io/jmr-dev/android-file-handler-debian-builder credentials: @@ -36,6 +39,9 @@ jobs: run-unit-tests-arch: runs-on: ubuntu-latest + permissions: + contents: read + packages: read container: image: ghcr.io/jmr-dev/android-file-handler-arch-builder credentials: @@ -150,6 +156,9 @@ jobs: build-debian: needs: [run-unit-tests-debian, run-unit-tests-arch, run-unit-tests-rhel, run-unit-tests-windows] + permissions: + contents: read + packages: read env: DISTRO_TYPE: debian runs-on: ubuntu-latest @@ -201,6 +210,9 @@ jobs: build-arch: needs: [run-unit-tests-debian, run-unit-tests-arch, run-unit-tests-rhel, run-unit-tests-windows] + permissions: + contents: read + packages: read env: DISTRO_TYPE: arch runs-on: ubuntu-latest