GitHub Workflows security hardening (#1162)

testing-library · Dec 12, 2022 · c43512a · c43512a
1 parent 801ad37
commit c43512a
Showing 1 changed file with 8 additions and 0 deletions.
diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml
@@ -12,6 +12,10 @@ on:
  - 'alpha'
  - '!all-contributors/**'
  pull_request: {}
+permissions:
+ actions: write # to cancel/stop running workflows (styfle/cancel-workflow-action)
+ contents: read # to fetch code (actions/checkout)
+
 jobs:
  main:
  continue-on-error: ${{ matrix.react != 'latest' }}
@@ -58,6 +62,10 @@ jobs:
  flags: ${{ matrix.react }}
 
  release:
+ permissions:
+ actions: write # to cancel/stop running workflows (styfle/cancel-workflow-action)
+ contents: write # to create release tags (cycjimmy/semantic-release-action)
+
  needs: main
  runs-on: ubuntu-latest
  if: