From 22552db27964b8e974414de599cbb0e3e827722f Mon Sep 17 00:00:00 2001
From: Valery Kharseko <vharseko@3a-systems.ru>
Date: Wed, 29 Jul 2026 04:49:21 +0000
Subject: [PATCH] Harden GitHub Actions workflows: least-privilege permissions and SHA-pinned actions (#778)
---
.github/workflows/deploy.yml | 5 +++++
1 files changed, 5 insertions(+), 0 deletions(-)
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index c065292..18d78a0 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -24,6 +24,11 @@
group: ${{ github.workflow }}-${{ github.event.workflow_run.head_branch }}
cancel-in-progress: false
+# contents: write is required to push the generated documentation to the project wiki
+# with github.token. The doc site push uses a separate PAT, not this token.
+permissions:
+ contents: write
+
jobs:
package-deploy-maven:
if: ${{ github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event=='push'}}
--
Gitblit v1.10.0