marko/cnpg-postgres-containers
1
0
Fork 0
forked from repo-mirrors/cnpg-postgres-containers
Code Pull Requests Actions Activity

ci(security): reduce workflow permissions (#207)

Browse Source 
By default, set all the workflow permissions to read-all, then 
provide permissions one by one to each job requiring more
permissions.

Closes #206

Signed-off-by: Jonathan Gonzalez V <jonathan.gonzalez@enterprisedb.com>
Signed-off-by: Francesco Canovai <francesco.canovai@enterprisedb.com>
This commit is contained in:
Jonathan Gonzalez V.
2025-05-29 15:38:50 +02:00
committed by GitHub
parent 037a5d142f
commit 5c35abd07e
3 changed files with 8 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
.github/workflows/update.yml vendored
View File

@@ -9,6 +9,8 @@ defaults:
run:
shell: 'bash -Eeuo pipefail -x {0}'
permissions: read-all
jobs:
build:
name: Run update script