Adding permissions to some workflows (#4698)

* Adding permissions to docs.yml and integration.yml

* Update codeql-analysis.yml

Adding top level read permissions to codeql workflow

* Update codeql-analysis.yml

Adding manual dispatch to codeql - to be able to test it easier

* Update deploy-fleet-website.yml

Adding top level read permission + write in the job so it can push the website

* Update test-website.yml

test-website should only need read permissions on content.

* Update fleet-and-orbit.yml

Testing Fleet and Orbit should be fine with top level read access

* Update fleetctl-preview.yml

fleetctl-preview should be fine with just read access at top level

* Update push-osquery-perf-to-ecr.yml

ECR is out of github so read permissions should be enough

* Update semgrep-analysis.yml

semgrep should only need read

* Update test-packaging.yml

Should only need read permission - setting on top

* Update test.yml

Should not need any write access - setting to READ on top.

* Update deploy-fleet-website.yml

Removing git write permission - since this pushes to Heroku not GitHub

* Tweaked as per Zach's comments

Removed some useless restrictions (contents none on a public repo for example)

* Removed meaningless permissions

contents: none - this does not have any security advantage on a public repo

This commit is contained in:

Guillaume Ross

2022-03-25 14:19:42 -04:00

committed by

GitHub

parent 6748e8bff6

commit b94972351f

10 changed files with 30 additions and 0 deletions

									
										.github/workflows/codeql-analysis.yml
									
		+4
		
												View File
												
				@@ -21,6 +21,10 @@ on:

				      - '**.tsx'

				  schedule:

				    - cron: '18 17 * * 1'

				  workflow_dispatch: # Manual

				permissions:

				    contents: read

				jobs:

				  analyze: