eeymoo/nvm
1
0
Fork 0
mirror of https://github.com/nvm-sh/nvm.git synced 2026-06-08 07:12:16 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

[actions] set per-job permissions in the nvm install workflow

Browse Source 
CodeQL (actions/missing-workflow-permissions)
flagged the matrix, test, and finisher jobs of nvm-install-test.yml for not declaring permissions.
Every other test workflow already sets least-privilege permissions per job; add them here to match:
`contents: read` for the matrix and test jobs, `contents: none` for the no-op finisher.
This commit is contained in:
Jordan Harband
2026-06-03 14:09:02 -07:00
parent c4d9239cbb
commit 16f6ddc3d5
1 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
.github/workflows/nvm-install-test.yml vendored
View File

@@ -15,6 +15,8 @@ permissions:
jobs: jobs:
matrix: matrix:
permissions:
contents: read
runs-on: ubuntu-latest runs-on: ubuntu-latest
outputs: outputs:
matrix: ${{ steps.matrix.outputs.matrix }} matrix: ${{ steps.matrix.outputs.matrix }}
@@ -43,6 +45,8 @@ jobs:
fi fi
test: test:
permissions:
contents: read
needs: [matrix] needs: [matrix]
runs-on: ubuntu-latest runs-on: ubuntu-latest
continue-on-error: ${{ matrix.ref == 'v0.40.0' }} # https://github.com/nvm-sh/nvm/issues/3405 continue-on-error: ${{ matrix.ref == 'v0.40.0' }} # https://github.com/nvm-sh/nvm/issues/3405
@@ -101,6 +105,8 @@ jobs:
fi fi
finisher: finisher:
permissions:
contents: none
runs-on: ubuntu-latest runs-on: ubuntu-latest
needs: [test] needs: [test]
steps: steps: