Add permissions for workflow runs

2026-08-18 10:06:37 +08:00 · 2026-06-30 14:24:48 +01:00
parent 0e89f0ef10
commit 7b8aba105b
11 changed files with 32 additions and 0 deletions
@@ -25,6 +25,8 @@ jobs:
  analyze:
    name: Analyze
    runs-on: ubuntu-latest
+    permissions:
+      security-events: write

    strategy:
      fail-fast: false
@@ -15,6 +15,9 @@ on:
      - fixes
      - release/*

+permissions:
+  contents: read
+
 jobs:
  coverage:
    runs-on: ubuntu-latest
@@ -5,6 +5,9 @@ on:
  schedule:
    - cron: "7 3 * * 0"

+permissions:
+  contents: read
+
 jobs:
  coverity:
    runs-on: ubuntu-latest
@@ -5,6 +5,9 @@ on:
  schedule:
    - cron: "7 3 * * 3"

+permissions:
+  contents: read
+
 jobs:
  coverity:
    runs-on: ubuntu-latest
@@ -5,6 +5,9 @@ on:
    - cron: '0 0 1 * *'
 # Run monthly, at 00:00 on the 1st day of month.

+permissions:
+  actions: write
+
 jobs:
  del_runs:
    runs-on: ubuntu-latest
@@ -17,6 +17,9 @@ on:
      - fixes
      - release/*

+permissions:
+  contents: read
+
 jobs:
  build:
    runs-on: ubuntu-latest
@@ -16,6 +16,9 @@ on:
  schedule:
    - cron: "0 2 * * 2"

+permissions:
+  contents: read
+
 jobs:
  build:
    runs-on: ubuntu-latest
@@ -17,6 +17,9 @@ on:
      - develop
      - release/*

+permissions:
+  contents: read
+
 jobs:
  build:
    runs-on: ubuntu-latest
@@ -17,6 +17,9 @@ on:
      - develop
      - release/*

+permissions:
+  contents: read
+
 env:
  # Customize the CMake build type here (Release, Debug, RelWithDebInfo, etc.)
  BUILD_TYPE: Release
@@ -17,6 +17,9 @@ on:
      - develop
      - release/*

+permissions:
+  contents: read
+
 jobs:
  build:
    runs-on: ubuntu-latest
@@ -17,6 +17,9 @@ on:
      - develop
      - release/*

+permissions:
+  contents: read
+
 env:
  # Customize the CMake build type here (Release, Debug, RelWithDebInfo, etc.)
  BUILD_TYPE: Release