docker
/
buildx
mirror of https://github.com/docker/buildx.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

ci: keep contents read permissions in jobs 

Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
This commit is contained in:
CrazyMax 2024-10-29 18:48:42 +01:00
parent cd8d61a9d7
commit e26911f403
No known key found for this signature in database
GPG Key ID: ADE44D8C9D44FBE4
3 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
.github/workflows/build.yml vendored
View File

@ -227,6 +227,8 @@ jobs:
govulncheck: govulncheck:
runs-on: ubuntu-24.04 runs-on: ubuntu-24.04
permissions: permissions:
# same as global permission
contents: read
# required to write sarif report # required to write sarif report
security-events: write security-events: write
steps: steps:
@ -372,6 +374,8 @@ jobs:
runs-on: ubuntu-24.04 runs-on: ubuntu-24.04
if: ${{ github.ref == 'refs/heads/master' && github.repository == 'docker/buildx' }} if: ${{ github.ref == 'refs/heads/master' && github.repository == 'docker/buildx' }}
permissions: permissions:
# same as global permission
contents: read
# required to write sarif report # required to write sarif report
security-events: write security-events: write
needs: needs:

1
.github/workflows/codeql.yml vendored
View File

@ -23,6 +23,7 @@ jobs:
codeql: codeql:
runs-on: ubuntu-24.04 runs-on: ubuntu-24.04
permissions: permissions:
contents: read
actions: read actions: read
security-events: write security-events: write
steps: steps:

3
.github/workflows/labeler.yml vendored
View File

@ -20,6 +20,9 @@ jobs:
labeler: labeler:
runs-on: ubuntu-latest runs-on: ubuntu-latest
permissions: permissions:
# same as global permission
contents: read
# required for writing labels
pull-requests: write pull-requests: write
steps: steps:
- -