docker
/
buildx
mirror of https://github.com/docker/buildx.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #2765 from crazy-max/ci-fix-content-read 

ci: keep contents read permissions in jobs
This commit is contained in:
CrazyMax 2024-10-29 19:04:45 +01:00 committed by GitHub
parent cd8d61a9d7 e26911f403
commit 14b31d8b77
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
3 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
.github/workflows/build.yml vendored
View File

@ -227,6 +227,8 @@ jobs:
govulncheck: govulncheck:
runs-on: ubuntu-24.04 runs-on: ubuntu-24.04
permissions: permissions:
# same as global permission
contents: read
# required to write sarif report # required to write sarif report
security-events: write security-events: write
steps: steps:
@ -372,6 +374,8 @@ jobs:
runs-on: ubuntu-24.04 runs-on: ubuntu-24.04
if: ${{ github.ref == 'refs/heads/master' && github.repository == 'docker/buildx' }} if: ${{ github.ref == 'refs/heads/master' && github.repository == 'docker/buildx' }}
permissions: permissions:
# same as global permission
contents: read
# required to write sarif report # required to write sarif report
security-events: write security-events: write
needs: needs:

1
.github/workflows/codeql.yml vendored
View File

@ -23,6 +23,7 @@ jobs:
codeql: codeql:
runs-on: ubuntu-24.04 runs-on: ubuntu-24.04
permissions: permissions:
contents: read
actions: read actions: read
security-events: write security-events: write
steps: steps:

3
.github/workflows/labeler.yml vendored
View File

@ -20,6 +20,9 @@ jobs:
labeler: labeler:
runs-on: ubuntu-latest runs-on: ubuntu-latest
permissions: permissions:
# same as global permission
contents: read
# required for writing labels
pull-requests: write pull-requests: write
steps: steps:
- -