From 0cb3fb8e3c11f727eca9638477e68344d8b061ad Mon Sep 17 00:00:00 2001 From: lebaudantoine Date: Fri, 13 Mar 2026 17:35:26 +0100 Subject: [PATCH] =?UTF-8?q?=F0=9F=94=A7(ci)=20explicitly=20set=20Docker=20?= =?UTF-8?q?Hub=20CI=20permissions=20to=20read-only?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Define read-only permissions in the workflow to clarify the expected access level and follow the principle of least privilege. --- .github/workflows/docker-hub.yml | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/.github/workflows/docker-hub.yml b/.github/workflows/docker-hub.yml index 628c505b..5871ac90 100644 --- a/.github/workflows/docker-hub.yml +++ b/.github/workflows/docker-hub.yml @@ -12,6 +12,9 @@ on: branches: - 'main' +permissions: + contents: read + env: DOCKER_USER: 1001:127 DOCKER_CONTAINER_REGISTRY_HOSTNAME: docker.io @@ -20,6 +23,8 @@ env: jobs: build-and-push-backend: runs-on: ubuntu-latest + permissions: + contents: read steps: - name: Checkout repository @@ -63,6 +68,8 @@ jobs: build-and-push-frontend-generic: runs-on: ubuntu-latest + permissions: + contents: read steps: - name: Checkout repository @@ -107,6 +114,8 @@ jobs: build-and-push-frontend-dinum: runs-on: ubuntu-latest + permissions: + contents: read steps: - name: Checkout repository @@ -151,6 +160,8 @@ jobs: build-and-push-summary: runs-on: ubuntu-latest + permissions: + contents: read steps: - name: Checkout repository @@ -197,6 +208,8 @@ jobs: build-and-push-agents: runs-on: ubuntu-latest + permissions: + contents: read steps: - name: Checkout repository @@ -242,6 +255,8 @@ jobs: labels: ${{ steps.meta.outputs.labels }} notify-argocd: + permissions: + contents: read needs: - build-and-push-frontend-generic - build-and-push-frontend-dinum