Add explicit permissions for CI jobs (#3204)

networkfusion · web-flow · commit 316f6e91272d · 2025-08-24T21:35:33.000+01:00
diff --git a/.github/workflows/devcontainer-all.yaml b/.github/workflows/devcontainer-all.yaml
@@ -21,6 +21,8 @@ jobs:
   build:
     if: ${{ vars.PUBLISH_DOCKER_IMAGE == 'true' }}
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
 
     - name: Checkout Repository
diff --git a/.github/workflows/devcontainer-azurertos.yaml b/.github/workflows/devcontainer-azurertos.yaml
@@ -21,6 +21,8 @@ jobs:
   build:
     if: ${{ vars.PUBLISH_DOCKER_IMAGE == 'true' }}
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
     
     - name: Checkout Repository
diff --git a/.github/workflows/devcontainer-chibios.yaml b/.github/workflows/devcontainer-chibios.yaml
@@ -21,6 +21,8 @@ jobs:
   build:
     if: ${{ vars.PUBLISH_DOCKER_IMAGE == 'true' }}
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
 
     - name: Checkout Repository
diff --git a/.github/workflows/devcontainer-esp32.yml b/.github/workflows/devcontainer-esp32.yml
@@ -21,6 +21,8 @@ jobs:
   build:
     if: ${{ vars.PUBLISH_DOCKER_IMAGE == 'true' }}
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
 
     - name: Checkout Repository
diff --git a/.github/workflows/devcontainer-freertos-nxp.yaml b/.github/workflows/devcontainer-freertos-nxp.yaml
@@ -21,6 +21,8 @@ jobs:
   build:
     if: ${{ vars.PUBLISH_DOCKER_IMAGE == 'true' }}
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
 
     - name: Checkout Repository
diff --git a/.github/workflows/devcontainer-smoketest.yaml b/.github/workflows/devcontainer-smoketest.yaml
@@ -31,6 +31,8 @@ jobs:
         ]
 
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
 
     steps:
       - uses: actions/checkout@v4
diff --git a/.github/workflows/devcontainer-ti.yaml b/.github/workflows/devcontainer-ti.yaml
@@ -21,6 +21,8 @@ jobs:
   build:
     if: ${{ vars.PUBLISH_DOCKER_IMAGE == 'true' }}
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
 
     - name: Checkout Repository

Original file line number	Diff line number	Diff line change
`@@ -31,6 +31,8 @@ jobs:`
`31`	`31`	`]`
`32`	`32`
`33`	`33`	`runs-on: ubuntu-latest`
	`34`	`+ permissions:`
	`35`	`+ contents: read`
`34`	`36`
`35`	`37`	`steps:`
`36`	`38`	`- uses: actions/checkout@v4`