modify job permissions (#1931)

Some of the jobs has unnecessary `read-all` access, this PR modifies the default access to none and a job can overwrite the permission.
google · Jan 25, 2024 · e484ee8 · e484ee8
1 parent aa58453
commit e484ee8
Show file tree

Hide file tree

Showing 3 changed files with 4 additions and 3 deletions.
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
@@ -21,7 +21,7 @@ on:
     branches: [ master ]
 
 
-permissions: read-all
+permissions: {}
 
 jobs:
   analyze:

diff --git a/.github/workflows/lint.yaml b/.github/workflows/lint.yaml
@@ -23,7 +23,8 @@ on:
   merge_group:
     branches: [ master ]
 
-permissions: read-all
+permissions:
+  contents: read
 
 jobs:
   lint:

diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml
@@ -8,7 +8,7 @@ on:
     branches: [ master ]
 
 # Declare default permissions as read only.
-permissions: read-all
+permissions: {}
 
 jobs:
   analysis: