[StepSecurity] ci: Harden GitHub Actions (#278)

Signed-off-by: StepSecurity Bot <bot@stepsecurity.io> Co-authored-by: StepSecurity Bot <bot@stepsecurity.io>
intel · Jun 18, 2024 · c81c270 · c81c270
1 parent 41193c9
commit c81c270
Show file tree

Hide file tree

Showing 4 changed files with 12 additions and 0 deletions.
diff --git a/.github/workflows/build-gprc-tls-docker-image.yml b/.github/workflows/build-gprc-tls-docker-image.yml
@@ -4,6 +4,9 @@ on:
   pull_request:
     branches: [ branch0.1/grpc-ra-tls ]
 
+permissions:
+  contents: read
+
 jobs:
 
   build:

diff --git a/.github/workflows/build-hfl-docker-image.yml b/.github/workflows/build-hfl-docker-image.yml
@@ -4,6 +4,9 @@ on:
   push:
     branches: [ main ]
 
+permissions:
+  contents: read
+
 jobs:
 
   build:

diff --git a/.github/workflows/build-main-docker-image.yml b/.github/workflows/build-main-docker-image.yml
@@ -4,6 +4,9 @@ on:
   push:
     branches: [ main ]
 
+permissions:
+  contents: read
+
 jobs:
   test_schedule:
     runs-on: ubuntu-latest

diff --git a/.github/workflows/build-tf-serving-docker-image.yml b/.github/workflows/build-tf-serving-docker-image.yml
@@ -4,6 +4,9 @@ on:
   pull_request:
     branches: [ branch0.1/tf-serving-cluster ]
 
+permissions:
+  contents: read
+
 jobs:
 
   build:
-Original file line number
+Diff line change
@@ Expand Up / @@ -4,6 +4,9 @@ on: @@
       push:
         branches: [ main ]
+    permissions:
+      contents: read
     jobs:
       build:
@@ Expand Down @@