From ac64f9caf525d2edb32be9675873db463c01d1d8 Mon Sep 17 00:00:00 2001
From: Varun Sharma <varunsh@stepsecurity.io>
Date: Thu, 2 Sep 2021 13:05:24 -0700
Subject: [PATCH] Secure workflows (#1) (#1072)

* Restrict permissions for the GITHUB_TOKEN in .github/workflows/label-feature.yml

* Restrict permissions for the GITHUB_TOKEN in .github/workflows/label-support.yml

* Restrict permissions for the GITHUB_TOKEN in .github/workflows/stale.yml

* Restrict permissions for the GITHUB_TOKEN in .github/workflows/sync_ghes.yaml

* Restrict permissions for the GITHUB_TOKEN in .github/workflows/validate-data.yaml

Co-authored-by: Step Security <bot@stepsecurity.io>

Co-authored-by: step-security[bot] <89328102+step-security[bot]@users.noreply.github.com>
Co-authored-by: Step Security <bot@stepsecurity.io>
---
 .github/workflows/label-feature.yml  | 2 ++
 .github/workflows/label-support.yml  | 2 ++
 .github/workflows/stale.yml          | 3 +++
 .github/workflows/sync_ghes.yaml     | 2 ++
 .github/workflows/validate-data.yaml | 2 ++
 5 files changed, 11 insertions(+)

diff --git a/.github/workflows/label-feature.yml b/.github/workflows/label-feature.yml
index 96ac8c1..d13cf87 100644
--- a/.github/workflows/label-feature.yml
+++ b/.github/workflows/label-feature.yml
@@ -5,6 +5,8 @@ on:
 
 jobs:
   build:
+    permissions:
+      issues: write
     runs-on: ubuntu-latest
     steps:
     - name: Close Issue
diff --git a/.github/workflows/label-support.yml b/.github/workflows/label-support.yml
index c6f2aa4..ea0f240 100644
--- a/.github/workflows/label-support.yml
+++ b/.github/workflows/label-support.yml
@@ -5,6 +5,8 @@ on:
 
 jobs:
   build:
+    permissions:
+      issues: write
     runs-on: ubuntu-latest
     steps:
     - name: Close Issue
diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
index c116b93..217078a 100644
--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -7,6 +7,9 @@ on:
 jobs:
   stale:
 
+    permissions:
+      issues: write
+      pull-requests: write
     runs-on: ubuntu-latest
 
     steps:
diff --git a/.github/workflows/sync_ghes.yaml b/.github/workflows/sync_ghes.yaml
index a3c298a..946218f 100644
--- a/.github/workflows/sync_ghes.yaml
+++ b/.github/workflows/sync_ghes.yaml
@@ -7,6 +7,8 @@ on:
 
 jobs:
   sync:
+    permissions:
+      contents: write
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v2
diff --git a/.github/workflows/validate-data.yaml b/.github/workflows/validate-data.yaml
index 745bc25..7d5c1ee 100644
--- a/.github/workflows/validate-data.yaml
+++ b/.github/workflows/validate-data.yaml
@@ -6,6 +6,8 @@ on:
 
 jobs:
   validate-data:
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v2