command-action: added scoped permissions to the github tokens (parity…

…tech#5016) This will ensure that malicious code can not access other parts of the project. Co-authored-by: Oliver Tale-Yazdi <[email protected]> Co-authored-by: Bastian Köcher <[email protected]>
moonbeam-foundation · Aug 2, 2024 · 28295e9 · 28295e9
1 parent 60423e1
commit 28295e9
Show file tree

Hide file tree

Showing 6 changed files with 18 additions and 0 deletions.
diff --git a/.github/workflows/command-bench-all.yml b/.github/workflows/command-bench-all.yml
@@ -66,6 +66,9 @@ jobs:
     runs-on: arc-runners-polkadot-sdk-weights
     container:
       image: ${{ needs.set-image.outputs.IMAGE }}
+    permissions:
+      contents: write
+      pull-requests: write
     steps:
       - name: Download repo
         uses: actions/checkout@v4

diff --git a/.github/workflows/command-bench-overhead.yml b/.github/workflows/command-bench-overhead.yml
@@ -45,6 +45,9 @@ jobs:
     runs-on: arc-runners-polkadot-sdk-benchmark
     container:
       image: ${{ needs.set-image.outputs.IMAGE }}
+    permissions:
+      contents: write
+      pull-requests: write
     steps:
       - name: Download repo
         uses: actions/checkout@v4

diff --git a/.github/workflows/command-bench.yml b/.github/workflows/command-bench.yml
@@ -91,6 +91,9 @@ jobs:
     runs-on: arc-runners-polkadot-sdk-benchmark
     container:
       image: ${{ needs.set-image.outputs.IMAGE }}
+    permissions:
+      contents: write
+      pull-requests: write
     steps:
       - name: Download repo
         uses: actions/checkout@v4

diff --git a/.github/workflows/command-fmt.yml b/.github/workflows/command-fmt.yml
@@ -23,6 +23,9 @@ jobs:
     timeout-minutes: 20
     container:
       image: ${{ needs.set-image.outputs.IMAGE }}
+    permissions:
+      contents: write
+      pull-requests: write
     steps:
       - name: Download repo
         uses: actions/checkout@v4

diff --git a/.github/workflows/command-sync.yml b/.github/workflows/command-sync.yml
@@ -38,6 +38,9 @@ jobs:
     runs-on: arc-runners-polkadot-sdk-warpsync
     container:
       image: ${{ needs.set-image.outputs.IMAGE }}
+    permissions:
+      contents: write
+      pull-requests: write
     steps:
       - name: Download repo
         uses: actions/checkout@v4

diff --git a/.github/workflows/command-update-ui.yml b/.github/workflows/command-update-ui.yml
@@ -26,6 +26,9 @@ jobs:
     timeout-minutes: 90
     container:
       image: ${{ needs.set-image.outputs.IMAGE }}
+    permissions:
+      contents: write
+      pull-requests: write
     steps:
       - name: Download repo
         uses: actions/checkout@v4