From a09a739fd1ed33389ba7e126dc97626c063894d6 Mon Sep 17 00:00:00 2001 From: Alex Date: Tue, 20 Sep 2022 16:09:01 +0200 Subject: [PATCH 1/2] build: harden docs.yaml permissions Signed-off-by: Alex --- .github/workflows/docs.yaml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/docs.yaml b/.github/workflows/docs.yaml index a8351dc9..60e7fc28 100644 --- a/.github/workflows/docs.yaml +++ b/.github/workflows/docs.yaml @@ -3,8 +3,12 @@ on: push: branches: - master +permissions: {} jobs: build_and_publish: + permissions: + contents: write # to push changes in repo (jamesives/github-pages-deploy-action) + name: Build and publish Docs runs-on: ubuntu-latest if: github.repository == 'PHPMailer/PHPMailer' From 01acbb66e063bae39ba3383d240bb22b24b602e8 Mon Sep 17 00:00:00 2001 From: Alex Date: Tue, 20 Sep 2022 16:12:44 +0200 Subject: [PATCH 2/2] build: harden tests.yml permissions Signed-off-by: Alex --- .github/workflows/tests.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index 0df9d9ca..df51dda0 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -6,6 +6,9 @@ on: # Allow manually triggering the workflow. workflow_dispatch: +permissions: + contents: read # to fetch code (actions/checkout) + jobs: coding-standard: