From 4e90e9afc851d336bae70af1faec7407d00922a7 Mon Sep 17 00:00:00 2001
From: Alex <93376818+sashashura@users.noreply.github.com>
Date: Mon, 29 Aug 2022 20:33:26 +0100
Subject: [PATCH] github workflows: security hardening

This PR adds explicit permissions section to workflows. This is a security
best practice because by default workflows run with extended set of permissions
(except from on: pull_request from external forks). By specifying any permission
explicitly all others are set to none. By using the principle of least privilege
the damage a compromised workflow can do (because of an injection or compromised
third party tool or action) is restricted. It is recommended to have most strict
permissions on the top level and grant write permissions on job level case by case.
---
 .github/workflows/openwrt-ci.yml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/.github/workflows/openwrt-ci.yml b/.github/workflows/openwrt-ci.yml
index 8677e5250..00a4d6000 100644
--- a/.github/workflows/openwrt-ci.yml
+++ b/.github/workflows/openwrt-ci.yml
@@ -12,11 +12,17 @@ on:
     - cron: 0 20 * * *
   release:
     types: [published]
+    
+permissions:
+  contents: read
 
 jobs:
 
   build_openwrt:
 
+    permissions:
+      contents: write # for release creation
+
     name: Build OpenWrt firmware
 
     runs-on: ubuntu-latest