Merge pull request #20 from saschpe/saschpe.actions

Set read-only permissions and configure Dependabot for workflows
saschpe · Jan 30, 2025 · ed71823 · ed71823
2 parents 07334cb + 3076e57
commit ed71823
Show file tree

Hide file tree

Showing 2 changed files with 18 additions and 1 deletion.
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
@@ -0,0 +1,14 @@
+version: 2
+updates:
+  - package-ecosystem: gradle
+    directory: "/"
+    schedule:
+      interval: weekly
+  - package-ecosystem: github-actions
+    directory: ".github/"
+    schedule:
+      interval: weekly
+  - package-ecosystem: docker
+    directory: "/"
+    schedule:
+      interval: weekly
diff --git a/.github/workflows/ci.yml → .github/workflows/main.yml b/.github/workflows/ci.yml → .github/workflows/main.yml
@@ -16,6 +16,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 env:
   IMAGE: saschpe/android-ndk
   PLATFORMS: linux/amd64,linux/arm64
@@ -32,7 +35,7 @@ jobs:
         cmake: [ 3.31.1 ]
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
       - name: Docker meta
         id: meta
         uses: docker/metadata-action@v5