ci(workflows): permissions updated in workflows

centralnicgroup-opensource · Nov 8, 2023 · 8eddd7c · 8eddd7c
1 parent 0e7110a
commit 8eddd7c
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 6 deletions.
diff --git a/.github/workflows/auto-merge-dependabot-pr.yml b/.github/workflows/auto-merge-dependabot-pr.yml
@@ -5,19 +5,21 @@ on:
       - opened
       - synchronize
 
-permissions:
-  contents: write
-  pull-requests: write
-
 jobs:
   tests:
     uses: ./.github/workflows/test.yml
     secrets: inherit
-
+  permissions:
+    contents: read
+
   dependabot:
     name: Auto-merge Dependabot PR
     runs-on: ubuntu-latest
     needs: tests
+    permissions:
+      contents: write
+      pull-requests: write
+
     if: ${{ github.actor == 'dependabot[bot]' }}
     steps:
       - name: Dependabot metadata

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -10,11 +10,17 @@ jobs:
   build:
     name: Build
     uses: ./.github/workflows/test.yml
-
+    secrets: inherit
+    permissions:
+      contents: read
+
   release:
     name: Release @ ubuntu-latest
     runs-on: ubuntu-latest
     needs: build
+    permissions:
+      contents: write
+
     steps:
       - name: Checkout
         uses: actions/checkout@v4