From 108833a94f97f0640be55ae50910265db4328c45 Mon Sep 17 00:00:00 2001
From: Jamie Magee <jamie.magee@gmail.com>
Date: Sat, 2 Jul 2022 11:35:28 -0700
Subject: [PATCH] ci: give write permissions to release phase only (#16394)
---
.github/workflows/build.yml | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 263b3aada1..9fb84d6e0e 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -15,9 +15,7 @@ on:
required: false
permissions:
- contents: write
- issues: write
- pull-requests: write
+ contents: read
concurrency:
group: ${{ github.workflow }}-${{ github.event.number || github.ref }}
@@ -150,6 +148,10 @@ jobs:
runs-on: ubuntu-latest
# release shouldn't need more than 5 min
timeout-minutes: 15
+ permissions:
+ contents: write
+ issues: write
+ pull-requests: write
steps:
# full checkout for semantic-release
--
GitLab