actions/starter-workflows
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ci: restrict starter workflow permissions

Browse Source 
Signed-off-by: Emmanuel Roullit <[email protected]>
This commit is contained in:
Emmanuel Roullit
2023-01-27 14:13:04 +01:00
parent ac13a846c9
commit f07709949e
1 changed files with 9 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
code-scanning/psalm.yml
+9 -1
View File
@@ -9,13 +9,21 @@ on:
push: push:
branches: [ $default-branch, $protected-branches ] branches: [ $default-branch, $protected-branches ]
pull_request: pull_request:
# The branches below must be a subset of the branches above
branches: [ $default-branch ] branches: [ $default-branch ]
schedule: schedule:
- cron: $cron-weekly - cron: $cron-weekly
permissions:
contents: read
jobs: jobs:
php-security: php-security:
runs-on: ubuntu-latest runs-on: ubuntu-latest
permissions:
contents: read # for actions/checkout to fetch code
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
steps: steps:
- name: Checkout code - name: Checkout code
@@ -27,4 +35,4 @@ jobs:
- name: Upload Security Analysis results to GitHub - name: Upload Security Analysis results to GitHub
uses: github/codeql-action/upload-sarif@v1 uses: github/codeql-action/upload-sarif@v1
with: with:
sarif_file: results.sarif sarif_file: results.sarif