Chore: Harden action permissions (#104820)

* harden action permissions * Update .github/workflows/ephemeral-instances-pr-comment.yml Co-authored-by: Kevin Minehart <5140827+kminehart@users.noreply.github.com> * update documentation-ci --------- Co-authored-by: Kevin Minehart <5140827+kminehart@users.noreply.github.com>
2025-05-02 12:13:05 +01:00
parent 9a7d85c85f
commit d8fb1e8e4e
11 changed files with 74 additions and 11 deletions
@@ -4,6 +4,9 @@ on:
    types: [created]
  pull_request:
    types: [closed]
+
+permissions: {}
+
 jobs:
  config:
    runs-on: "ubuntu-latest"
@@ -26,6 +29,10 @@ jobs:
          fi

  handle-pull-request-event:
+    permissions:
+      id-token: write
+      contents: read
+      pull-requests: write
    needs: config
    if: needs.config.outputs.has-secrets &&
        ${{ github.event.issue.pull_request && (startsWith(github.event.comment.body, '/deploy-to-hg') || github.event.action == 'closed') }}