diff --git a/.github/workflows/wf4.yml b/.github/workflows/wf4.yml index 3a7a156..dbfa3b2 100644 --- a/.github/workflows/wf4.yml +++ b/.github/workflows/wf4.yml @@ -1,26 +1,26 @@ -name: Test GitHubToken Excessive Permissions -on: - push: - branches: - - main -jobs: - test-permissions: - runs-on: ubuntu-latest - # Overly broad permissions for GITHUB_TOKEN - permissions: - contents: write - issues: write - pull-requests: write - actions: write - checks: write - deployments: write - statuses: write - packages: write - repository-projects: write - discussions: write - security-events: write # This one, in particular, should raise a flag as it's typically not needed for most workflows - steps: - - name: Checkout code - uses: actions/checkout@v3 - - name: Dummy Step - run: echo "This is to test excessive token permissions" \ No newline at end of file +name: Test GitHubToken Permissions + on: + push: + branches: + - main + jobs: + test-permissions: + runs-on: ubuntu-latest + # Minimal permissions for GITHUB_TOKEN + permissions: + contents: read + issues: none + pull-requests: none + actions: none + checks: read + deployments: none + statuses: read + packages: none + repository-projects: none + discussions: none + security-events: none + steps: + - name: Checkout code + uses: actions/checkout@v3 + - name: Dummy Step + run: echo "Testing minimal token permissions" \ No newline at end of file