Skip to content

Add minimum GitHub token permissions for workflows  #7540

Closed
@joycebrum

Description

@joycebrum

@akarnokd can I bring up this topic (#7469) again and perhaps suggest a PR with the permission that were missing in this one? It is really a relevant topic on supply-chain security that prevents any threats and attacks.

But before I would like to understand what didn't work on https://github.com/ReactiveX/RxJava/actions/runs/2343714818/jobs/3517587271 because for me it shows as success.

Looking into gradle_snapshot.yml and gradle_release.yml I've noticed that perhaps the permission that were missing was a contents: write to run this command

git push --quiet --set-upstream origin-pages gh-pages

Let me know if a PR is welcome and I'll try testing it before submit it, although I think it will be difficult considering sonatype access used.

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions