Skip to content
Merged
Show file tree
Hide file tree
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Add 'permissions: {}' to all workflows
  • Loading branch information
hugovk committed Apr 5, 2026
commit c49536fd3f79b3f7332d3562e127a5195927406a
1 change: 1 addition & 0 deletions .github/workflows/add-issue-header.yml
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,7 @@ on:
# Only ever run once
- opened

permissions: {}

jobs:
add-header:
Expand Down
3 changes: 1 addition & 2 deletions .github/workflows/build.yml
Original file line number Diff line number Diff line change
Expand Up @@ -11,8 +11,7 @@ on:
- 'main'
- '3.*'

permissions:
contents: read
permissions: {}

concurrency:
# https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#concurrency
Expand Down
3 changes: 1 addition & 2 deletions .github/workflows/jit.yml
Original file line number Diff line number Diff line change
Expand Up @@ -15,8 +15,7 @@ on:
paths: *paths
workflow_dispatch:

permissions:
contents: read
permissions: {}

concurrency:
group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
Expand Down
3 changes: 1 addition & 2 deletions .github/workflows/lint.yml
Original file line number Diff line number Diff line change
Expand Up @@ -2,8 +2,7 @@ name: Lint

on: [push, pull_request, workflow_dispatch]

permissions:
contents: read
permissions: {}

env:
FORCE_COLOR: 1
Expand Down
3 changes: 1 addition & 2 deletions .github/workflows/mypy.yml
Original file line number Diff line number Diff line change
Expand Up @@ -33,8 +33,7 @@ on:
- "Tools/requirements-dev.txt"
workflow_dispatch:

permissions:
contents: read
permissions: {}

env:
PIP_DISABLE_PIP_VERSION_CHECK: 1
Expand Down
5 changes: 3 additions & 2 deletions .github/workflows/new-bugs-announce-notifier.yml
Original file line number Diff line number Diff line change
Expand Up @@ -5,12 +5,13 @@ on:
types:
- opened

permissions:
issues: read
permissions: {}

jobs:
notify-new-bugs-announce:
runs-on: ubuntu-latest
permissions:
issues: read
timeout-minutes: 10
steps:
- uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
Expand Down
2 changes: 2 additions & 0 deletions .github/workflows/require-pr-label.yml
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,8 @@ on:
pull_request:
types: [opened, reopened, labeled, unlabeled, synchronize]

permissions: {}

jobs:
label-dnm:
name: DO-NOT-MERGE
Expand Down
2 changes: 2 additions & 0 deletions .github/workflows/stale.yml
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,8 @@ on:
schedule:
- cron: "0 */6 * * *"

permissions: {}

jobs:
stale:
if: github.repository_owner == 'python'
Expand Down
3 changes: 1 addition & 2 deletions .github/workflows/tail-call.yml
Original file line number Diff line number Diff line change
Expand Up @@ -11,8 +11,7 @@ on:
paths: *paths
workflow_dispatch:

permissions:
contents: read
permissions: {}

concurrency:
group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
Expand Down
3 changes: 1 addition & 2 deletions .github/workflows/verify-ensurepip-wheels.yml
Original file line number Diff line number Diff line change
Expand Up @@ -13,8 +13,7 @@ on:
- '.github/workflows/verify-ensurepip-wheels.yml'
- 'Tools/build/verify_ensurepip_wheels.py'

permissions:
contents: read
permissions: {}

concurrency:
group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
Expand Down
3 changes: 1 addition & 2 deletions .github/workflows/verify-expat.yml
Original file line number Diff line number Diff line change
Expand Up @@ -11,8 +11,7 @@ on:
- 'Modules/expat/**'
- '.github/workflows/verify-expat.yml'

permissions:
contents: read
permissions: {}

concurrency:
group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
Expand Down
Loading