Harden the ci infrastructure for better security

Following some of the advice given in briansmith/untrusted#50.
Jacalz · Oct 31, 2021 · 9b703bf · 9b703bf
1 parent ba7b22e
commit 9b703bf
Show file tree

Hide file tree

Showing 3 changed files with 12 additions and 0 deletions.
diff --git a/.github/workflows/mobile_tests.yml b/.github/workflows/mobile_tests.yml
@@ -1,5 +1,7 @@
 name: Mobile Tests
 on: [push, pull_request]
+permissions:
+ contents: read
 
 jobs:
  mobile_tests:
@@ -11,6 +13,8 @@ jobs:
 
  steps:
  - uses: actions/checkout@v2
+ with:
+ persist-credentials: false
  - uses: WillAbides/[email protected]
  with:
  go-version: ${{ matrix.go-version }}

diff --git a/.github/workflows/platform_tests.yml b/.github/workflows/platform_tests.yml
@@ -1,5 +1,7 @@
 name: Platform Tests
 on: [push, pull_request]
+permissions:
+ contents: read
 
 jobs:
  platform_tests:
@@ -12,6 +14,8 @@ jobs:
 
  steps:
  - uses: actions/checkout@v2
+ with:
+ persist-credentials: false
  - uses: WillAbides/[email protected]
  id: setup-go-faster
  with:

diff --git a/.github/workflows/static_analysis.yml b/.github/workflows/static_analysis.yml
@@ -1,11 +1,15 @@
 name: Static Analysis
 on: [push, pull_request]
+permissions:
+ contents: read
 
 jobs:
  checks:
  runs-on: ubuntu-latest
  steps:
  - uses: actions/checkout@v2
+ with:
+ persist-credentials: false
  - uses: WillAbides/[email protected]
  with:
  go-version: '1.17.x'