Harden GitHub Actions workflows: least-privilege permissions and SHA-pinned...

Valery Kharseko

12 hours ago 22552db27964b8e974414de599cbb0e3e827722f

 .github/workflows/deploy.yml

@@ -24,6 +24,11 @@
  group: ${{ github.workflow }}-${{ github.event.workflow_run.head_branch }}
  cancel-in-progress: false

# contents: write is required to push the generated documentation to the project wiki
# with github.token. The doc site push uses a separate PAT, not this token.
permissions:
  contents: write

jobs:
  package-deploy-maven:
    if: ${{ github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event=='push'}}