build: harden ci.yml permissions

Signed-off-by: Alex <[email protected]>
google · Sep 19, 2023 · d5cd47e · d5cd47e
1 parent c9726da
commit d5cd47e
Showing 1 changed file with 10 additions and 0 deletions.
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -8,8 +8,15 @@ on:
     branches:
     - master
 
+permissions:
+  contents: read #  to fetch code (actions/checkout)
+
 jobs:
   test:
+    permissions:
+      actions: write #  to cancel/stop running workflows (styfle/cancel-workflow-action)
+      contents: read #  to fetch code (actions/checkout)
+
     name: "JDK ${{ matrix.java }} on ${{ matrix.os }}"
     strategy:
       fail-fast: false
@@ -93,6 +100,9 @@ jobs:
         run: mvn source:jar deploy -B -DskipTests=true -Dinvoker.skip=true
 
   generate_docs:
+    permissions:
+      contents: write #  for git push
+
     name: 'Generate latest docs'
     needs: test
     if: github.event_name == 'push' && github.repository == 'google/error-prone' && github.ref == 'refs/heads/master'