From 7c569e3d14896e455305676cac6abd288ce70a70 Mon Sep 17 00:00:00 2001 From: Ryan Inch Date: Mon, 6 Jul 2026 08:59:07 -0400 Subject: [PATCH] Restrict spoke-RetPageOrigin workflow to minimum required permissions What: sets the permissions of the spoke-RetPageOrigin workflow to none. Why: to minimize the chance of the workflow being hacked and in preparation to globally restrict permissions for all Hubs Foundation workflows. Note: the permissions setting was advised by `GitHubSecurityLab/actions-permissions/monitor@bf82d13b9b10051d224345ab9184f5ede0a94289 #v1 Beta 9` --- .github/workflows/spoke-RetPageOrigin.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/spoke-RetPageOrigin.yml b/.github/workflows/spoke-RetPageOrigin.yml index b7423310..af3a6074 100644 --- a/.github/workflows/spoke-RetPageOrigin.yml +++ b/.github/workflows/spoke-RetPageOrigin.yml @@ -5,6 +5,8 @@ on: paths-ignore: ["README.md"] workflow_dispatch: +permissions: {} + jobs: turkeyGitops: uses: Hubs-Foundation/hubs-ops/.github/workflows/turkeyGitops.yml@master