Merge pull request #34201 from backstage/freben/harden-bot-changeset-workflows

ci: add explicit permissions to pull_request_target workflows
2026-05-12 23:38:59 +02:00
parent f5709382c9 17c0551651
commit fcdf63f54b
3 changed files with 13 additions and 0 deletions
@@ -5,6 +5,10 @@ on:
      - '.github/workflows/sync_dependabot-changesets.yml'
      - '**/yarn.lock'

+permissions:
+  contents: write
+  pull-requests: write
+
 jobs:
  generate-changeset:
    runs-on: ubuntu-latest
@@ -16,6 +16,11 @@ on:
  issue_comment:
    types: [created]

+permissions:
+  actions: none
+  contents: none
+  pull-requests: none
+
 jobs:
  trigger:
    if: >
@@ -5,6 +5,10 @@ on:
      - '.github/workflows/sync_renovate-changesets.yml'
      - '**/yarn.lock'

+permissions:
+  contents: write
+  pull-requests: write
+
 jobs:
  generate-changeset:
    runs-on: ubuntu-latest