CI: Set minimal permissions to your GitHub Workflows about little-cms HOT 6 CLOSED

Hello Diogo, thanks for contacting.
Of course it will help a lot if you can setup a PR so after code scrutiny we could integrate it. Thanks for your help!

from little-cms.

Sure! I'll raise a PR shortly =)

from little-cms.

Thanks for the PR, will merge it soon

from little-cms.

Hey @mm2,
I'm coming back to this issue because seems like the changes of my PR #368 are not on the code anymore. However I looked into the commit history and there is no commit directly removing the changes. Was the removal intentional? If not, I'd be happy to raise a new PR fixing it

from little-cms.

@diogoteles08
Many thanks for pointing out, I didn't notice those changes were lost. No, it was not intentional, I assume the PR I accepted for meson build broke the file. It would be great if you could manage to setup a PR. Thanks again!

from little-cms.

Great! I've just opened a new PR on this.

My core job is to look over important OSS projects and suggest security enhancements, so I'll be around to suggest and possibly implement changes like this one. However, if you'd like to take a closer look yourself into the security posture of your repo, you can use the Scorecard GitHub Action. It would automatically run some security checks over your repo and propose fixes directly on your Security Tab. As an example, it would have alerted you when my changes on the permissions were lost.

Additionally, if you decide to make the security changes yourself, your changes might be eligible to financial rewards through Secure Open Source Rewards 😄.

from little-cms.