From 9653185048dd9e4fdb2dc75e3c751a4072b73bb7 Mon Sep 17 00:00:00 2001 From: Alex Date: Thu, 3 Nov 2022 23:52:00 +0200 Subject: [PATCH] build: harden codeql-analysis.yml permissions Signed-off-by: Alex --- .github/workflows/codeql-analysis.yml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index af9006adf..4923571a6 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -11,8 +11,15 @@ on: schedule: - cron: '30 12 * * 2' +permissions: + contents: read # to fetch code (actions/checkout) + jobs: analyze: + permissions: + contents: read # to fetch code (actions/checkout) + security-events: write # (github/codeql-action/autobuild) + if: github.repository == 'ipfs/kubo' || github.event_name == 'workflow_dispatch' name: Analyze runs-on: ubuntu-latest