ci: GitHub Workflows security hardening (googleapis#10657)

sashashura · web-flow · commit 7b5ff28f9c74 · 2022-08-31T09:46:19.000-04:00
Signed-off-by: sashashura &lt;93376818+sashashura@users.noreply.github.com&gt;

Signed-off-by: sashashura &lt;93376818+sashashura@users.noreply.github.com&gt;
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
@@ -21,8 +21,13 @@ on:
     # Run this Github Action every Tuesday at 7 AM UTC
     - cron:  '0 7 * * 2'
 
+permissions:
+  contents: read
+
 jobs:
   build:
+    permissions:
+      pull-requests: write # for googleapis/code-suggester
     name: Update API List PR
     runs-on: ubuntu-latest
     # don't run the workflow on forks of googleapis/google-cloud-python
@@ -55,4 +60,4 @@ jobs:
           title: 'docs: update the list of available APIs'
           message: 'docs: update the list of available APIs'
           branch: update-api-list-${{ steps.date.outputs.current_date }}
-          git_dir: '.'
+          git_dir: '.'
