[StepSecurity] ci: Harden GitHub Actions (#507)
This commit is contained in:
Родитель
79b4ef0ef8
Коммит
3dc7ec1e82
|
@ -23,13 +23,18 @@ on:
|
|||
schedule:
|
||||
- cron: '43 3 * * 3'
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
jobs:
|
||||
analyze:
|
||||
name: Analyze (C/C++)
|
||||
runs-on: windows-latest
|
||||
timeout-minutes: 360
|
||||
permissions:
|
||||
security-events: write
|
||||
actions: read # for github/codeql-action/init to get workflow details
|
||||
contents: read # for actions/checkout to fetch code
|
||||
security-events: write # for github/codeql-action/autobuild to send a status report
|
||||
packages: read
|
||||
|
||||
steps:
|
||||
|
|
|
@ -21,6 +21,9 @@ on:
|
|||
- build/*.targets
|
||||
- build/*.yml
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
jobs:
|
||||
build:
|
||||
runs-on: ${{ matrix.os }}
|
||||
|
|
|
@ -24,6 +24,9 @@ on:
|
|||
env:
|
||||
DIRECTXTEX_MEDIA_PATH: ${{ github.workspace }}/Media
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
jobs:
|
||||
build:
|
||||
runs-on: ${{ matrix.os }}
|
||||
|
|
|
@ -15,6 +15,9 @@ on:
|
|||
- LICENSE
|
||||
- build/*
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
jobs:
|
||||
build:
|
||||
runs-on: ${{ matrix.os }}
|
||||
|
|
Загрузка…
Ссылка в новой задаче