CI Adds permissions to workflows that use GITHUB_TOKEN (scikit-learn#25600)

thomasjpfan · ogrisel · jpangas · commit 6575cbabcccd · 2023-03-06T23:01:50.000+03:00
Co-authored-by: Olivier Grisel &lt;olivier.grisel@ensta.org&gt;
diff --git a/.github/workflows/artifact-redirector.yml b/.github/workflows/artifact-redirector.yml
@@ -1,5 +1,12 @@
 name: CircleCI artifacts redirector
 on: [status]
+
+# Restrict the permissions granted to the use of secrets.GITHUB_TOKEN in this
+# github actions workflow:
+# https://docs.github.com/en/actions/security-guides/automatic-token-authentication
+permissions:
+  statuses: write
+
 jobs:
   circleci_artifacts_redirector_job:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/assign.yml b/.github/workflows/assign.yml
@@ -4,6 +4,12 @@ on:
   issue_comment:
     types: created
 
+# Restrict the permissions granted to the use of secrets.GITHUB_TOKEN in this
+# github actions workflow:
+# https://docs.github.com/en/actions/security-guides/automatic-token-authentication
+permissions:
+  issues: write
+
 jobs:
   one:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/labeler-module.yml b/.github/workflows/labeler-module.yml
@@ -3,6 +3,13 @@ on:
   pull_request_target:
     types: [opened]
 
+# Restrict the permissions granted to the use of secrets.GITHUB_TOKEN in this
+# github actions workflow:
+# https://docs.github.com/en/actions/security-guides/automatic-token-authentication
+permissions:
+  contents: read
+  pull-requests: write
+
 jobs:
   triage:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/labeler-title-regex.yml b/.github/workflows/labeler-title-regex.yml
@@ -3,6 +3,9 @@ on:
   pull_request_target:
     types: [opened, edited]
 
+# Restrict the permissions granted to the use of secrets.GITHUB_TOKEN in this
+# github actions workflow:
+# https://docs.github.com/en/actions/security-guides/automatic-token-authentication
 permissions:
   contents: read
   pull-requests: write
diff --git a/.github/workflows/unassign.yml b/.github/workflows/unassign.yml
@@ -4,6 +4,12 @@ on:
   issues:
     types: unassigned
 
+# Restrict the permissions granted to the use of secrets.GITHUB_TOKEN in this
+# github actions workflow:
+# https://docs.github.com/en/actions/security-guides/automatic-token-authentication
+permissions:
+  issues: write
+
 jobs:
   one:
     runs-on: ubuntu-latest
