This is an automated email from the ASF dual-hosted git repository.
alamb pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/arrow-rs.git
The following commit(s) were added to refs/heads/main by this push:
new 9f9db79d31 chore: set permissions in github action workflows (#10536)
9f9db79d31 is described below
commit 9f9db79d3106ed06089fe1eebbbaf35659cbe713
Author: Jeffrey Vo <[email protected]>
AuthorDate: Wed Aug 5 01:48:29 2026 +0900
chore: set permissions in github action workflows (#10536)
resolving these issues flagged by codeql
<img width="915" height="587" alt="image"
src="https://github.com/user-attachments/assets/45095053-fb35-4b5e-8805-16d975545a1e";
/>
---
.github/workflows/arrow.yml | 4 +++-
.github/workflows/arrow_flight.yml | 3 +++
.github/workflows/audit.yml | 3 +++
.github/workflows/dev.yml | 4 +++-
.github/workflows/docs.yml | 3 ++-
.github/workflows/integration.yml | 3 +++
.github/workflows/miri.yaml | 3 +++
.github/workflows/parquet-geospatial.yml | 3 +++
.github/workflows/parquet-variant.yml | 3 +++
.github/workflows/parquet.yml | 3 +++
.github/workflows/parquet_derive.yml | 3 +++
.github/workflows/rust.yml | 3 +++
12 files changed, 35 insertions(+), 3 deletions(-)
diff --git a/.github/workflows/arrow.yml b/.github/workflows/arrow.yml
index 336e74ecf9..4d2ded6d92 100644
--- a/.github/workflows/arrow.yml
+++ b/.github/workflows/arrow.yml
@@ -48,8 +48,10 @@ on:
- arrow-string/**
- arrow/**
-jobs:
+permissions:
+ contents: read
+jobs:
# test the crate
linux-test:
name: Test
diff --git a/.github/workflows/arrow_flight.yml
b/.github/workflows/arrow_flight.yml
index 34f7286ec2..1e158dabe3 100644
--- a/.github/workflows/arrow_flight.yml
+++ b/.github/workflows/arrow_flight.yml
@@ -41,6 +41,9 @@ on:
- arrow-select/**
- .github/**
+permissions:
+ contents: read
+
jobs:
linux-test:
name: Test
diff --git a/.github/workflows/audit.yml b/.github/workflows/audit.yml
index 744af3d9bc..0fe4d0d8c7 100644
--- a/.github/workflows/audit.yml
+++ b/.github/workflows/audit.yml
@@ -32,6 +32,9 @@ on:
- '**/Cargo.lock'
- rust-toolchain.toml
+permissions:
+ contents: read
+
jobs:
cargo-audit:
name: Audit
diff --git a/.github/workflows/dev.yml b/.github/workflows/dev.yml
index b75bbe2f0f..73b7ca7615 100644
--- a/.github/workflows/dev.yml
+++ b/.github/workflows/dev.yml
@@ -28,8 +28,10 @@ on:
- main
pull_request:
-jobs:
+permissions:
+ contents: read
+jobs:
rat:
name: Release Audit Tool (RAT)
runs-on: ubuntu-latest
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index ee6ea97358..54f5387aa3 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -29,11 +29,12 @@ on:
pull_request:
jobs:
-
# test doc links still work
docs:
name: Rustdocs are clean
runs-on: ubuntu-latest
+ permissions:
+ contents: read
container:
image: amd64/rust
env:
diff --git a/.github/workflows/integration.yml
b/.github/workflows/integration.yml
index b2625cb421..df22097e5b 100644
--- a/.github/workflows/integration.yml
+++ b/.github/workflows/integration.yml
@@ -49,6 +49,9 @@ on:
- arrow-string/**
- arrow/**
+permissions:
+ contents: read
+
jobs:
integration:
name: Archery test With other arrows
diff --git a/.github/workflows/miri.yaml b/.github/workflows/miri.yaml
index 7d2d2cec64..b7e3d5760f 100644
--- a/.github/workflows/miri.yaml
+++ b/.github/workflows/miri.yaml
@@ -43,6 +43,9 @@ on:
- arrow-string/**
- arrow/**
+permissions:
+ contents: read
+
jobs:
miri-checks:
name: MIRI
diff --git a/.github/workflows/parquet-geospatial.yml
b/.github/workflows/parquet-geospatial.yml
index 1b0441443b..e20ed05884 100644
--- a/.github/workflows/parquet-geospatial.yml
+++ b/.github/workflows/parquet-geospatial.yml
@@ -34,6 +34,9 @@ on:
- rust-toolchain.toml
- .github/**
+permissions:
+ contents: read
+
jobs:
# test the crate
linux-test:
diff --git a/.github/workflows/parquet-variant.yml
b/.github/workflows/parquet-variant.yml
index 73ca57220d..68ada75a5c 100644
--- a/.github/workflows/parquet-variant.yml
+++ b/.github/workflows/parquet-variant.yml
@@ -36,6 +36,9 @@ on:
- rust-toolchain.toml
- .github/**
+permissions:
+ contents: read
+
jobs:
# test the crate
linux-test:
diff --git a/.github/workflows/parquet.yml b/.github/workflows/parquet.yml
index 158f1f08ae..5836468053 100644
--- a/.github/workflows/parquet.yml
+++ b/.github/workflows/parquet.yml
@@ -48,6 +48,9 @@ on:
- parquet-variant-json/**
- .github/**
+permissions:
+ contents: read
+
jobs:
# test the crate
linux-test:
diff --git a/.github/workflows/parquet_derive.yml
b/.github/workflows/parquet_derive.yml
index 69641cbc8c..26665808c1 100644
--- a/.github/workflows/parquet_derive.yml
+++ b/.github/workflows/parquet_derive.yml
@@ -36,6 +36,9 @@ on:
- rust-toolchain.toml
- .github/**
+permissions:
+ contents: read
+
jobs:
# test the crate
linux-test:
diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml
index 7862248ae0..3297f8591e 100644
--- a/.github/workflows/rust.yml
+++ b/.github/workflows/rust.yml
@@ -29,6 +29,9 @@ on:
- main
pull_request:
+permissions:
+ contents: read
+
jobs:
# Check workspace wide compile and test with default features for
# mac
