Archives/lancedikson_bowser
1
0
Fork 0
mirror of https://github.com/lancedikson/bowser synced 2026-10-08 11:52:04 +00:00
Code Issues Releases Wiki Activity

ci: restrict the pull-request workflow GITHUB_TOKEN to contents: read

Browse Source
This commit is contained in:
naorpeled
2026-08-29 23:50:17 +03:00
parent 434016a1f9
commit 876f2b81ca
1 changed files with 5 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
.github/workflows/pull-request.yml vendored
View File

@@ -3,6 +3,11 @@ on:
pull_request: pull_request:
types: [opened, reopened, synchronize] types: [opened, reopened, synchronize]
# Every job only reads the repo and moves artifacts between jobs; none of them
# needs write access to anything.
permissions:
contents: read
env: env:
# tsdown requires Node ^22.18.0 || >=24.11.0. This is the *build* toolchain # tsdown requires Node ^22.18.0 || >=24.11.0. This is the *build* toolchain
# only — see the `pack-smoke` job for the versions the published package # only — see the `pack-smoke` job for the versions the published package