build: harden codeql-analysis.yml permissions
Signed-off-by: Alex <aleksandrosansan@gmail.com>
Alex committed
Nov 3, 2022 at 23:52 UTC
9653185048dd9e4fdb2dc75e3c751a4072b73bb7
1 file changed
+7
.github/workflows/codeql-analysis.yml
+7
@@ -11,8 +11,15 @@ on:
11
schedule:
12
- cron: '30 12 * * 2'
13
14
+permissions:
15
+ contents: read # to fetch code (actions/checkout)
16
+
17
jobs:
18
analyze:
19
+ permissions:
20
+ contents: read # to fetch code (actions/checkout)
21
+ security-events: write # (github/codeql-action/autobuild)
22
+
23
if: github.repository == 'ipfs/kubo' || github.event_name == 'workflow_dispatch'
24
name: Analyze
25
runs-on: ubuntu-latest