[groovy] branch master updated: chore: Set permissions for GitHub actions

[pa...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

paulk pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/groovy.git


The following commit(s) were added to refs/heads/master by this push:
     new 30ea41d273 chore: Set permissions for GitHub actions
30ea41d273 is described below

commit 30ea41d273cae2c55bd6e5c30e5b2d3fd6087a28
Author: neilnaveen <42...@users.noreply.github.com>
AuthorDate: Sat Jun 11 01:08:28 2022 +0000

    chore: Set permissions for GitHub actions
    
     Restrict the GitHub token permissions only to the required ones; this way, even if the attackers will succeed in compromising your workflow, they won’t be able to do much.
    
    - Included permissions for the action. https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions
    
    https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
    
    https://docs.github.com/en/actions/using-jobs/assigning-permissions-to-jobs
    
    [Keeping your GitHub Actions and workflows secure Part 1: Preventing pwn requests](https://securitylab.github.com/research/github-actions-preventing-pwn-requests/)
    
    Signed-off-by: neilnaveen <42...@users.noreply.github.com>
---
 .github/workflows/gradle-wrapper-validation.yml  | 3 +++
 .github/workflows/grails-joint-validation.yml    | 3 +++
 .github/workflows/groovy-build-dist.yml          | 3 +++
 .github/workflows/groovy-build-test.yml          | 3 +++
 .github/workflows/micronaut-joint-validation.yml | 3 +++
 5 files changed, 15 insertions(+)

diff --git a/.github/workflows/gradle-wrapper-validation.yml b/.github/workflows/gradle-wrapper-validation.yml
index c6c0844a62..5c9ac191a1 100644
--- a/.github/workflows/gradle-wrapper-validation.yml
+++ b/.github/workflows/gradle-wrapper-validation.yml
@@ -16,6 +16,9 @@
 name: "Validate Gradle Wrapper"
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   validation:
     name: "Validation"
diff --git a/.github/workflows/grails-joint-validation.yml b/.github/workflows/grails-joint-validation.yml
index faeecdf2bf..e362c3435c 100644
--- a/.github/workflows/grails-joint-validation.yml
+++ b/.github/workflows/grails-joint-validation.yml
@@ -28,6 +28,9 @@ on:
       - GROOVY_2_5_X
       - GROOVY_3_0_X
 #      - master
+permissions:
+  contents: read
+
 jobs:
   build:
     strategy:
diff --git a/.github/workflows/groovy-build-dist.yml b/.github/workflows/groovy-build-dist.yml
index e376ed68ec..ce740fdb33 100644
--- a/.github/workflows/groovy-build-dist.yml
+++ b/.github/workflows/groovy-build-dist.yml
@@ -17,6 +17,9 @@ name: Distribute SNAPSHOT
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   dist:
     strategy:
diff --git a/.github/workflows/groovy-build-test.yml b/.github/workflows/groovy-build-test.yml
index 0a7a8a27cf..9da2968f03 100644
--- a/.github/workflows/groovy-build-test.yml
+++ b/.github/workflows/groovy-build-test.yml
@@ -17,6 +17,9 @@ name: Build and test
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   test:
     strategy:
diff --git a/.github/workflows/micronaut-joint-validation.yml b/.github/workflows/micronaut-joint-validation.yml
index ba5dfb92ae..eed27b958e 100644
--- a/.github/workflows/micronaut-joint-validation.yml
+++ b/.github/workflows/micronaut-joint-validation.yml
@@ -21,6 +21,9 @@ on:
   pull_request:
     branches:
       - GROOVY_3_0_X
+permissions:
+  contents: read
+
 jobs:
   build:
     strategy: