[cloudstack] branch main updated: GitHub Workflows security hardening (#6762)

[da...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

dahn pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/cloudstack.git


The following commit(s) were added to refs/heads/main by this push:
     new 80c999cc81e GitHub Workflows security hardening (#6762)
80c999cc81e is described below

commit 80c999cc81ebc73a448fffdd9912eab85ec9b3ce
Author: Alex <al...@gmail.com>
AuthorDate: Tue Apr 25 16:35:39 2023 +0200

    GitHub Workflows security hardening (#6762)
    
    Signed-off-by: Alex <al...@gmail.com>
---
 .github/workflows/main-sonar-check.yml | 4 ++++
 .github/workflows/sonar-check.yml      | 4 ++++
 2 files changed, 8 insertions(+)

diff --git a/.github/workflows/main-sonar-check.yml b/.github/workflows/main-sonar-check.yml
index 429b0607552..527701debc1 100644
--- a/.github/workflows/main-sonar-check.yml
+++ b/.github/workflows/main-sonar-check.yml
@@ -22,6 +22,10 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read # to fetch code (actions/checkout)
+  pull-requests: write # for sonar to comment on pull-request
+
 jobs:
   build:
     name: Main Sonar JaCoCo Build
diff --git a/.github/workflows/sonar-check.yml b/.github/workflows/sonar-check.yml
index 2bfdaf0a65f..54329bf47b1 100644
--- a/.github/workflows/sonar-check.yml
+++ b/.github/workflows/sonar-check.yml
@@ -26,6 +26,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read # to fetch code (actions/checkout)
+  pull-requests: write # for sonar to comment on pull-request
+
 jobs:
   build:
     if: github.repository == 'apache/cloudstack'