GitHub Workflows security hardening (Seldaek#1763)

Signed-off-by: Alex <[email protected]>
salehhashemi1992 · Feb 4, 2023 · 3b866c9 · 3b866c9
1 parent 8255feb
commit 3b866c9
Show file tree

Hide file tree

Showing 3 changed files with 9 additions and 0 deletions.
diff --git a/.github/workflows/continuous-integration.yml b/.github/workflows/continuous-integration.yml
@@ -4,6 +4,9 @@ on:
   - push
   - pull_request
 
+permissions:
+  contents: read # to fetch code (actions/checkout)
+
 jobs:
   tests:
     name: "CI (PHP ${{ matrix.php-version }}, ${{ matrix.dependencies }} deps)"

diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
@@ -4,6 +4,9 @@ on:
   push:
   pull_request:
 
+permissions:
+  contents: read # to fetch code (actions/checkout)
+
 jobs:
   tests:
     name: "Lint"

diff --git a/.github/workflows/phpstan.yml b/.github/workflows/phpstan.yml
@@ -7,6 +7,9 @@ on:
 env:
   COMPOSER_FLAGS: "--ansi --no-interaction --no-progress --prefer-dist"
 
+permissions:
+  contents: read # to fetch code (actions/checkout)
+
 jobs:
   tests:
     name: "PHPStan"