ivuorinen/actions
1
0
Fork 0
mirror of https://github.com/ivuorinen/actions.git synced 2026-03-06 09:56:27 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: harden workflow permissions with deny-all top-level and least-privilege job scopes (#482)

Browse Source
This commit is contained in:
Copilot
2026-03-06 02:44:56 +02:00
committed by GitHub
parent 455267f892
commit ae4ad9ec80
12 changed files with 32 additions and 35 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
.github/workflows/codeql-new.yml vendored
View File

@@ -13,17 +13,16 @@ on:
- cron: '30 1 * * 0' # Run at 1:30 AM UTC every Sunday
merge_group:
permissions:
actions: read
contents: read
permissions: {}
jobs:
analyze:
name: Analyze (${{ matrix.language }})
runs-on: ubuntu-latest
permissions:
security-events: write
actions: read
contents: read
security-events: write
strategy:
fail-fast: false