ossf: fix token permissions (#2410)

Signed-off-by: Matthieu MOREL <[email protected]>
envoyproxy · Jan 6, 2024 · 859a76b · 859a76b
1 parent eb26959
commit 859a76b
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 5 deletions.
diff --git a/.github/workflows/latest_release.yaml b/.github/workflows/latest_release.yaml
@@ -1,18 +1,20 @@
 name: Latest Release
 
+permissions:
+  contents: read
+
 on:
   push:
     branches:
     - "main"
     paths-ignore:
     - "**/*.png"
 
-permissions:
-  contents: write
-
 jobs:
   latest-release:
     runs-on: ubuntu-22.04
+    permissions:
+      contents: write
     steps:
     - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11  # v4.1.1
     - uses: ./tools/github-actions/setup-deps

diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
@@ -1,16 +1,19 @@
 name: Release
 
+permissions:
+  contents: read
+
 on:
   push:
     # Sequence of patterns matched against refs/tags
     tags:
       - "v*.*.*"
-permissions:
-  contents: write
 
 jobs:
   release:
     runs-on: ubuntu-22.04
+    permissions:
+      contents: write
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11  # v4.1.1