ci: scope GitHub Actions workflows (#36890)

* Scope GitHub Actions workflow and job permissions * Fix workflow permissions gaps from least-privilege scoping
2026-09-24 16:05:00 +08:00 · 2026-06-04 19:40:30 +02:00
parent 3fc5b94292
commit 3af36e0a49
33 changed files with 195 additions and 25 deletions
@@ -7,12 +7,12 @@ on:
  schedule:
    - cron: "30 5,17 * * *"

-permissions:
-  contents: read
+permissions: {}

 jobs:
  analyze:
    permissions:
+      contents: read
      security-events: write # for github/codeql-action/autobuild to send a status report
    name: Analyze
    if: github.repository_owner == 'mattermost'