From d068052f0ce16bcb3cb81c9361cc56744a315a52 Mon Sep 17 00:00:00 2001 From: holger krekel Date: Wed, 29 Jul 2026 09:23:34 +0200 Subject: [PATCH] restrict usable workflow to read permissions --- .github/workflows/ci-no-dns.yaml | 2 ++ .github/workflows/ci.yaml | 2 ++ 2 files changed, 4 insertions(+) diff --git a/.github/workflows/ci-no-dns.yaml b/.github/workflows/ci-no-dns.yaml index 51211bdd..48a35fff 100644 --- a/.github/workflows/ci-no-dns.yaml +++ b/.github/workflows/ci-no-dns.yaml @@ -20,6 +20,8 @@ concurrency: jobs: no-dns: name: LXC deploy and test + permissions: + contents: read uses: chatmail/cmlxc/.github/workflows/lxc-test.yml@main with: cmlxc_version: main diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index d34f79b1..1fe6a8c7 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -57,6 +57,8 @@ jobs: lxc-test: name: LXC deploy and test + permissions: + contents: read uses: chatmail/cmlxc/.github/workflows/lxc-test.yml@main with: cmlxc_version: main