chore(ci): Set token permissions for GitHub Actions workflows (#498)

Signed-off-by: Joonas Bergius <[email protected]>
wasmCloud · Dec 2, 2024 · 21feab0 · 21feab0
1 parent eb6fce9
commit 21feab0
Show file tree

Hide file tree

Showing 5 changed files with 20 additions and 0 deletions.
diff --git a/.github/workflows/chart.yml b/.github/workflows/chart.yml
@@ -13,6 +13,9 @@ on:
       - 'charts/**'
       - '.github/workflows/chart.yml'
 
+permissions:
+  contents: read
+
 jobs:
   validate:
     runs-on: ubuntu-22.04
@@ -72,6 +75,7 @@ jobs:
     runs-on: ubuntu-22.04
     needs: validate
     permissions:
+      contents: read
       packages: write
 
     steps:

diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml
@@ -5,6 +5,9 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 jobs:
   test:
     name: e2e

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -9,6 +9,9 @@ on:
       - 'client-v*'
   workflow_dispatch: # Allow manual creation of artifacts without a release
 
+permissions:
+  contents: read
+
 defaults:
   run:
     shell: bash
@@ -107,6 +110,8 @@ jobs:
     name: publish release assets
     runs-on: ubuntu-latest
     needs: build
+    permissions:
+      contents: write
     env:
       RELEASE_VERSION: ${{ needs.build.outputs.version_output }}
     steps:

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
@@ -5,6 +5,9 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 jobs:
   test:
     name: Test

diff --git a/.github/workflows/wit-wadm.yaml b/.github/workflows/wit-wadm.yaml
@@ -5,9 +5,14 @@ on:
     tags:
       - 'wit-wasmcloud-wadm-v*'
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     steps:
     - uses: actions/checkout@v4
       with: