CI

Author: albertus82

.github/workflows/build.yml

@@ -5,6 +5,8 @@ on: [ push, workflow_dispatch ]
 jobs:
   build:
     name: Build
+    permissions:
+      contents: read
     strategy:
       fail-fast: false
       matrix:

.github/workflows/release.yml

@@ -7,9 +7,9 @@ on:
 jobs:
   publish:
     name: Publish
-    runs-on: ubuntu-latest
     permissions:
       contents: write
+    runs-on: ubuntu-latest
     env:
       MAVEN_OPTS: -Dhttp.keepAlive=false
     steps:

.github/workflows/snapshot.yml

@@ -8,6 +8,8 @@ on:
 jobs:
   publish:
     name: Publish
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
     env:
       MAVEN_OPTS: -Dhttp.keepAlive=false

.github/workflows/sonar.yml

@@ -5,6 +5,8 @@ on: push
 jobs:
   analyze:
     name: Analyze
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
     env:
       MAVEN_OPTS: -Dhttp.keepAlive=false