From 1b0822be49137ab766eaea19817e2c7104a8def0 Mon Sep 17 00:00:00 2001 From: cpovirk Date: Mon, 3 Aug 2026 09:13:07 -0700 Subject: [PATCH] Enact some security improvements that I'd missed in previous rounds. For each project, that includes some subset of: - `zizmor` fixes (this time for [excessive permissions](https://docs.zizmor.sh/audits/#excessive-permissions)): compare https://github.com/google/caliper/commit/01844f3fdb3b0220b7a667a8cfe4992945303f20 (or cl/957369925 for excessive permissions specifically) - migration off `styfle/cancel-workflow-action` (which requires write permissions): compare https://github.com/google/caliper/commit/c2a896403f6cc531c32ee0f8295d84b97b97fee0 - Relatedly, set up cancellation for bazel_common using the replacement we're using elsewhere (`concurrency`), since bazel_common didn't have cancellation set up at all yet. - Dependabot `cooldown`: compare https://github.com/google/caliper/commit/9c03308037b31dc10d97f86446c0a0cb1a87e151 RELNOTES=n/a PiperOrigin-RevId: 958410064 --- .github/workflows/ci.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 04234824..50678d45 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -13,6 +13,9 @@ concurrency: group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }} cancel-in-progress: true +permissions: + contents: read + jobs: test: name: "JDK ${{ matrix.java }}"