[actions] restrict permissions for GITHUB_TOKEN

2021-09-10 06:09:45 +00:00
parent 2dad0455ec
commit 59532c74c6
8 changed files with 32 additions and 0 deletions
--- a/.github/workflows/latest-npm.yml
+++ b/.github/workflows/latest-npm.yml
@@ -4,6 +4,8 @@ on: [pull_request, push]

 jobs:
  nodes:
+    permissions:
+      contents: read
    name: 'nvm install-latest-npm'
    runs-on: ubuntu-latest

@@ -44,6 +46,8 @@ jobs:
      - run: npm --version

  node:
+    permissions:
+      contents: none
    name: 'nvm install-latest-npm'
    needs: [nodes]
    runs-on: ubuntu-latest