natas_hw
/
grpc
0
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

GitHub Workflows security hardening (#31057) 

* build: harden pr-auto-fix.yaml permissions
Signed-off-by: Alex <aleksandrosansan@gmail.com>

* build: harden pr-auto-tag.yaml permissions
Signed-off-by: Alex <aleksandrosansan@gmail.com>
This commit is contained in:
Alex 2022-10-10 03:52:14 +03:00 committed by GitHub
parent afa3a6c890
commit 90beb3f4c4
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 13 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
.github/workflows/pr-auto-fix.yaml vendored
View File

@ -1,7 +1,13 @@
name: PR AutoFix
on: [push]
permissions: {}
jobs:
PRAutoFix:
permissions:
actions: write # to cancel/stop running workflows (styfle/cancel-workflow-action)
contents: write # to create branch (peter-evans/create-pull-request)
pull-requests: write # to create a PR (peter-evans/create-pull-request)
runs-on: ubuntu-latest
steps:
# Cache bazel build

7
.github/workflows/pr-auto-tag.yaml vendored
View File

@ -2,8 +2,15 @@ name: PR AutoTag
on:
pull_request_target:
types: [opened, reopened, synchronized, edited]
permissions:
contents: read # to determine modified files (actions/labeler)
jobs:
triage:
permissions:
contents: read # to determine modified files (actions/labeler)
pull-requests: write # to add labels to PRs (actions/labeler)
runs-on: ubuntu-latest
steps:
- uses: actions/labeler@v3