Merge pull request #549 from crazy-max/zizmor-fixes

ci: restrict update-dist GitHub App token scope
2026-05-23 08:55:54 +00:00 · 2026-05-21 14:58:05 +02:00 · 2026-05-21 14:58:05 +02:00 · fe05060e96
commit fe05060e96
parent a0c73a10bb d717e33d65
1 changed files with 2 additions and 0 deletions
--- a/.github/workflows/update-dist.yml
+++ b/.github/workflows/update-dist.yml
@ -26,6 +26,8 @@ jobs:
          app-id: ${{ secrets.GHACTIONS_REPO_WRITE_APP_ID }}
          private-key: ${{ secrets.GHACTIONS_REPO_WRITE_APP_PRIVATE_KEY }}
          owner: docker
+          repositories: setup-buildx-action
+          permission-contents: write
      -
        name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2