mirror of
https://github.com/python-pillow/Pillow.git
synced 2024-12-25 09:26:16 +03:00
chore: Set permissions for GitHub actions
Restrict the GitHub token permissions only to the required ones; this way, even if the attackers will succeed in compromising your workflow, they won’t be able to do much. - Included permissions for the action. https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions https://docs.github.com/en/actions/using-jobs/assigning-permissions-to-jobs [Keeping your GitHub Actions and workflows secure Part 1: Preventing pwn requests](https://securitylab.github.com/research/github-actions-preventing-pwn-requests/) Signed-off-by: neilnaveen <42328488+neilnaveen@users.noreply.github.com>
This commit is contained in:
parent
26e2c7e030
commit
43b185e1c1
3
.github/workflows/lint.yml
vendored
3
.github/workflows/lint.yml
vendored
|
@ -2,6 +2,9 @@ name: Lint
|
||||||
|
|
||||||
on: [push, pull_request, workflow_dispatch]
|
on: [push, pull_request, workflow_dispatch]
|
||||||
|
|
||||||
|
permissions:
|
||||||
|
contents: read
|
||||||
|
|
||||||
jobs:
|
jobs:
|
||||||
build:
|
build:
|
||||||
|
|
||||||
|
|
6
.github/workflows/release-drafter.yml
vendored
6
.github/workflows/release-drafter.yml
vendored
|
@ -7,8 +7,14 @@ on:
|
||||||
- main
|
- main
|
||||||
workflow_dispatch:
|
workflow_dispatch:
|
||||||
|
|
||||||
|
permissions:
|
||||||
|
contents: read
|
||||||
|
|
||||||
jobs:
|
jobs:
|
||||||
update_release_draft:
|
update_release_draft:
|
||||||
|
permissions:
|
||||||
|
contents: write # for release-drafter/release-drafter to create a github release
|
||||||
|
pull-requests: write # for release-drafter/release-drafter to add label to PR
|
||||||
if: github.repository == 'python-pillow/Pillow'
|
if: github.repository == 'python-pillow/Pillow'
|
||||||
runs-on: ubuntu-latest
|
runs-on: ubuntu-latest
|
||||||
steps:
|
steps:
|
||||||
|
|
2
.github/workflows/test-cygwin.yml
vendored
2
.github/workflows/test-cygwin.yml
vendored
|
@ -99,6 +99,8 @@ jobs:
|
||||||
name: Cygwin Python 3.${{ matrix.python-minor-version }}
|
name: Cygwin Python 3.${{ matrix.python-minor-version }}
|
||||||
|
|
||||||
success:
|
success:
|
||||||
|
permissions:
|
||||||
|
contents: none
|
||||||
needs: build
|
needs: build
|
||||||
runs-on: ubuntu-latest
|
runs-on: ubuntu-latest
|
||||||
name: Cygwin Test Successful
|
name: Cygwin Test Successful
|
||||||
|
|
5
.github/workflows/test-docker.yml
vendored
5
.github/workflows/test-docker.yml
vendored
|
@ -2,6 +2,9 @@ name: Test Docker
|
||||||
|
|
||||||
on: [push, pull_request, workflow_dispatch]
|
on: [push, pull_request, workflow_dispatch]
|
||||||
|
|
||||||
|
permissions:
|
||||||
|
contents: read
|
||||||
|
|
||||||
jobs:
|
jobs:
|
||||||
build:
|
build:
|
||||||
|
|
||||||
|
@ -82,6 +85,8 @@ jobs:
|
||||||
name: ${{ matrix.docker }}
|
name: ${{ matrix.docker }}
|
||||||
|
|
||||||
success:
|
success:
|
||||||
|
permissions:
|
||||||
|
contents: none
|
||||||
needs: build
|
needs: build
|
||||||
runs-on: ubuntu-latest
|
runs-on: ubuntu-latest
|
||||||
name: Docker Test Successful
|
name: Docker Test Successful
|
||||||
|
|
5
.github/workflows/test-mingw.yml
vendored
5
.github/workflows/test-mingw.yml
vendored
|
@ -2,6 +2,9 @@ name: Test MinGW
|
||||||
|
|
||||||
on: [push, pull_request, workflow_dispatch]
|
on: [push, pull_request, workflow_dispatch]
|
||||||
|
|
||||||
|
permissions:
|
||||||
|
contents: read
|
||||||
|
|
||||||
jobs:
|
jobs:
|
||||||
build:
|
build:
|
||||||
runs-on: windows-latest
|
runs-on: windows-latest
|
||||||
|
@ -77,6 +80,8 @@ jobs:
|
||||||
CODECOV_NAME: ${{ matrix.name }}
|
CODECOV_NAME: ${{ matrix.name }}
|
||||||
|
|
||||||
success:
|
success:
|
||||||
|
permissions:
|
||||||
|
contents: none
|
||||||
needs: build
|
needs: build
|
||||||
runs-on: ubuntu-latest
|
runs-on: ubuntu-latest
|
||||||
name: MinGW Test Successful
|
name: MinGW Test Successful
|
||||||
|
|
3
.github/workflows/test-valgrind.yml
vendored
3
.github/workflows/test-valgrind.yml
vendored
|
@ -13,6 +13,9 @@ on:
|
||||||
- "**.h"
|
- "**.h"
|
||||||
workflow_dispatch:
|
workflow_dispatch:
|
||||||
|
|
||||||
|
permissions:
|
||||||
|
contents: read
|
||||||
|
|
||||||
jobs:
|
jobs:
|
||||||
build:
|
build:
|
||||||
|
|
||||||
|
|
5
.github/workflows/test-windows.yml
vendored
5
.github/workflows/test-windows.yml
vendored
|
@ -2,6 +2,9 @@ name: Test Windows
|
||||||
|
|
||||||
on: [push, pull_request, workflow_dispatch]
|
on: [push, pull_request, workflow_dispatch]
|
||||||
|
|
||||||
|
permissions:
|
||||||
|
contents: read
|
||||||
|
|
||||||
jobs:
|
jobs:
|
||||||
build:
|
build:
|
||||||
runs-on: windows-latest
|
runs-on: windows-latest
|
||||||
|
@ -189,6 +192,8 @@ jobs:
|
||||||
path: dist\*.whl
|
path: dist\*.whl
|
||||||
|
|
||||||
success:
|
success:
|
||||||
|
permissions:
|
||||||
|
contents: none
|
||||||
needs: build
|
needs: build
|
||||||
runs-on: ubuntu-latest
|
runs-on: ubuntu-latest
|
||||||
name: Windows Test Successful
|
name: Windows Test Successful
|
||||||
|
|
5
.github/workflows/test.yml
vendored
5
.github/workflows/test.yml
vendored
|
@ -2,6 +2,9 @@ name: Test
|
||||||
|
|
||||||
on: [push, pull_request, workflow_dispatch]
|
on: [push, pull_request, workflow_dispatch]
|
||||||
|
|
||||||
|
permissions:
|
||||||
|
contents: read
|
||||||
|
|
||||||
jobs:
|
jobs:
|
||||||
build:
|
build:
|
||||||
|
|
||||||
|
@ -109,6 +112,8 @@ jobs:
|
||||||
CODECOV_NAME: ${{ matrix.os }} Python ${{ matrix.python-version }}
|
CODECOV_NAME: ${{ matrix.os }} Python ${{ matrix.python-version }}
|
||||||
|
|
||||||
success:
|
success:
|
||||||
|
permissions:
|
||||||
|
contents: none
|
||||||
needs: build
|
needs: build
|
||||||
runs-on: ubuntu-latest
|
runs-on: ubuntu-latest
|
||||||
name: Test Successful
|
name: Test Successful
|
||||||
|
|
3
.github/workflows/tidelift.yml
vendored
3
.github/workflows/tidelift.yml
vendored
|
@ -12,6 +12,9 @@ on:
|
||||||
- ".github/workflows/tidelift.yml"
|
- ".github/workflows/tidelift.yml"
|
||||||
workflow_dispatch:
|
workflow_dispatch:
|
||||||
|
|
||||||
|
permissions:
|
||||||
|
contents: read
|
||||||
|
|
||||||
jobs:
|
jobs:
|
||||||
build:
|
build:
|
||||||
if: github.repository_owner == 'python-pillow'
|
if: github.repository_owner == 'python-pillow'
|
||||||
|
|
Loading…
Reference in New Issue
Block a user