[StepSecurity] ci: Harden GitHub Actions (#250)
This commit is contained in:
Родитель
5468766a16
Коммит
940dd7c5be
|
@ -23,13 +23,18 @@ on:
|
|||
schedule:
|
||||
- cron: '19 7 * * 1'
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
jobs:
|
||||
analyze:
|
||||
name: Analyze (C/C++)
|
||||
runs-on: windows-latest
|
||||
timeout-minutes: 360
|
||||
permissions:
|
||||
security-events: write
|
||||
actions: read # for github/codeql-action/init to get workflow details
|
||||
contents: read # for actions/checkout to fetch code
|
||||
security-events: write # for github/codeql-action/autobuild to send a status report
|
||||
packages: read
|
||||
|
||||
steps:
|
||||
|
|
|
@ -21,6 +21,9 @@ on:
|
|||
- build/*.targets
|
||||
- build/*.yml
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
jobs:
|
||||
build:
|
||||
runs-on: ${{ matrix.os }}
|
||||
|
|
|
@ -21,6 +21,9 @@ on:
|
|||
- build/*.targets
|
||||
- build/*.yml
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
jobs:
|
||||
build:
|
||||
runs-on: ${{ matrix.os }}
|
||||
|
|
|
@ -15,6 +15,9 @@ on:
|
|||
- LICENSE
|
||||
- build/*
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
jobs:
|
||||
build:
|
||||
runs-on: ${{ matrix.os }}
|
||||
|
|
Загрузка…
Ссылка в новой задаче