Minimize workflow job permissions
Open
b4b
devops
- Dominant language
- Fortran
- Stars
- 352
- Forks
- 361
- Avg merge
- 2d 21h
- Merged PRs (30d)
- 7
Description
This is [required](https://cirrus-hpc-docs.k8s.ucar.edu/en/latest/compute-systems/cirrus/users/github/best-practices/#limit-github-token-permissions) (or at least strongly recommended) for the CIRRUS self-hosted runners.
- All jobs without permissions set: explicitly set to read-only.
- [docker-image-common/build-image-and-test-docs](https://github.com/ESCOMP/CTSM/blob/d43d777c3fc5920b581c0bf2f7554c54fe366a4c/.github/workflows/docker-image-common.yml): Does this really need write? I would think [docker-image-build-publish/push-and-attest](https://github.com/ESCOMP/CTSM/blob/d43d777c3fc5920b581c0bf2f7554c54fe366a4c/.github/workflows/docker-image-build-publish.yml#L23) is the only one that needs it.
Contributor guide
Assessment
This issue has not been assessed yet.