From c43d7b1f11954f218b15ff347b0ec3585e9ce10d Mon Sep 17 00:00:00 2001 From: SarthakWade Date: Thu, 10 Sep 2026 22:45:19 +0530 Subject: [PATCH] security: limit cask workflow permissions --- .github/workflows/update-cask.yml | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/.github/workflows/update-cask.yml b/.github/workflows/update-cask.yml index 2688924..23929ce 100644 --- a/.github/workflows/update-cask.yml +++ b/.github/workflows/update-cask.yml @@ -16,7 +16,7 @@ on: type: string permissions: - contents: write + contents: read concurrency: group: update-headless-cask @@ -27,7 +27,9 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 5 steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Validate updater run: | bash -n scripts/update-cask.sh scripts/test-update-cask.sh @@ -38,8 +40,10 @@ jobs: if: github.event_name != 'pull_request' runs-on: macos-latest timeout-minutes: 15 + permissions: + contents: write steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Verify release and render cask id: render env: