chore(ci): Follow up to workflow permissions (#11397)

Following up with more tinkering of the workflow permissions. I'll have to just test the publishing ones by merging and watching it not break.
redwoodjs · Aug 30, 2024 · 5e6c258 · 5e6c258
1 parent de0529b
commit 5e6c258
Show file tree

Hide file tree

Showing 4 changed files with 6 additions and 2 deletions.
diff --git a/.github/workflows/check-test-project-fixture.yml b/.github/workflows/check-test-project-fixture.yml
@@ -41,8 +41,6 @@ jobs:
     if: needs.detect-changes.outputs.code == 'true'
     name: Check test project fixture
     runs-on: ubuntu-latest
-    permissions:
-      actions: write
     steps:
       - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
 

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -11,6 +11,8 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 env:
   NX_CLOUD_ACCESS_TOKEN: ${{ secrets.NX_CLOUD_ACCESS_TOKEN }}
   YARN_ENABLE_HARDENED_MODE: 0

diff --git a/.github/workflows/publish-canary.yml b/.github/workflows/publish-canary.yml
@@ -14,6 +14,8 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   publish-canary:
     name: 🦜 Publish Canary

diff --git a/.github/workflows/publish-release-candidate.yml b/.github/workflows/publish-release-candidate.yml
@@ -14,6 +14,8 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   check-git-tags:
     name: 🏷 Check git tags