Set read-only tokens for all workflows (#2075)

Signed-off-by: Pedro Kaj Kjellerup Nacht <[email protected]>
keras-team · Sep 14, 2023 · 0cff8e2 · 0cff8e2
1 parent 5cdae3b
commit 0cff8e2
Show file tree

Hide file tree

Showing 3 changed files with 10 additions and 0 deletions.
diff --git a/.github/workflows/actions.yml b/.github/workflows/actions.yml
@@ -5,6 +5,10 @@ on:
   pull_request:
   release:
     types: [created]
+
+permissions:
+  contents: read
+
 jobs:
   test:
     name: Test the code with tf.keras

diff --git a/.github/workflows/devcontainer.yml b/.github/workflows/devcontainer.yml
@@ -11,6 +11,8 @@ on: # rebuild any PRs and main branch changes
       - '.devcontainer/**'
       - 'workflows/**'
 
+permissions:
+  contents: read
 
 jobs:
   build:

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -3,6 +3,10 @@ name: Release
 on:
   release:
     types: [published]
+
+permissions:
+  contents: read
+
 jobs:
   deploy-with-custom-ops:
     # This job is currently skipped until we cut a release with custom ops.