[openssh-commits] [openssh] 01/03: Explicitly set workflow permissions to read-only.

[git+noreply at mindrot.org]

This is an automated email from the git hooks/post-receive script.

dtucker pushed a commit to branch master
in repository openssh.

commit f62b04286673e74f2c005bf836a3cc1e6f8a8cf3
Author: Darren Tucker <dtucker at dtucker.net>
AuthorDate: Sat Oct 17 13:02:31 2026 +1100

    Explicitly set workflow permissions to read-only.
    
    This is already enforced in both repo and org settings, but some
    analysis tools seem to like seeing it explicitly stated.
---
 .github/workflows/c-cpp.yml      | 4 ++--
 .github/workflows/cifuzz.yml     | 1 +
 .github/workflows/selfhosted.yml | 2 +-
 .github/workflows/upstream.yml   | 2 +-
 .github/workflows/vm.yml         | 1 +
 5 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/c-cpp.yml b/.github/workflows/c-cpp.yml
index 049f95f80..74bb8c8a2 100644
--- a/.github/workflows/c-cpp.yml
+++ b/.github/workflows/c-cpp.yml
@@ -1,5 +1,3 @@
-name: CI
-
 # For testing, you can set variables in your repo (Repo -> Settings ->
 # Security -> Actions -> Variables) to restrict the tests that are run.
 # The supported variables are:
@@ -11,6 +9,8 @@ name: CI
 # LTESTS: Override the set of tests run.
 # TEST_SSH_TRACE: Set to yes for additional regress output.
 
+name: CI
+permissions: read-all
 on:
   push:
     paths: [ '**.c', '**.h', '**.m4', '**.sh', '**/Makefile.in', 'configure.ac', 'regress/Makefile', '.github/configs', '.github/*.sh', '.github/workflows/c-cpp.yml' ]
diff --git a/.github/workflows/cifuzz.yml b/.github/workflows/cifuzz.yml
index f649f7921..cbaba3d9f 100644
--- a/.github/workflows/cifuzz.yml
+++ b/.github/workflows/cifuzz.yml
@@ -1,4 +1,5 @@
 name: CIFuzz
+permissions: read-all
 on:
   push:
     paths: [ '**.c', '**.cc', '**.h', '**.m4', '**.sh', '**/Makefile.in', '**/Makefile', 'configure.ac', '.github/configs', '.github/workflows/cifuzz.yml' ]
diff --git a/.github/workflows/selfhosted.yml b/.github/workflows/selfhosted.yml
index 6ea3540a7..e91f7ae85 100644
--- a/.github/workflows/selfhosted.yml
+++ b/.github/workflows/selfhosted.yml
@@ -1,5 +1,5 @@
 name: CI self-hosted
-
+permissions: read-all
 on:
   push:
     paths: [ '**.c', '**.h', '**.m4', '**.sh', '**/Makefile.in', 'configure.ac','regress/Makefile',  '.github/configs', '.github/run_tests.sh', '.github/workflows/selfhosted.yml' ]
diff --git a/.github/workflows/upstream.yml b/.github/workflows/upstream.yml
index d40b509fd..da5b5a8f4 100644
--- a/.github/workflows/upstream.yml
+++ b/.github/workflows/upstream.yml
@@ -1,5 +1,5 @@
 name: OpenBSD
-
+permissions: read-all
 on:
   push:
     branches: [ master ]
diff --git a/.github/workflows/vm.yml b/.github/workflows/vm.yml
index 706ed65dd..6b6c4c4d6 100644
--- a/.github/workflows/vm.yml
+++ b/.github/workflows/vm.yml
@@ -5,6 +5,7 @@
 # RUN_ONLY_PLATFORM: run only tests on specified platform.
 
 name: CI VM
+permissions: read-all
 on:
   push:
     paths: [ '**.c', '**.h', '**.m4', '**.sh', '**/Makefile.in', 'configure.ac', 'regress/Makefile', '.github/configs', '.github/workflows/vm.yml' ]

-- 
To stop receiving notification emails like this one, please contact
djm at mindrot.org.