Merge remote-tracking branch 'turrisxyz/Pinned-Dependencies-GitHub'

* turrisxyz/Pinned-Dependencies-GitHub:
  chore: Set permissions for GitHub actions

.github/workflows/coverity-scan.yml

@@ -4,6 +4,9 @@ on:
   schedule:
     - cron: '0 0 * * 1,3,5'
 
+permissions:
+  contents: read
+
 jobs:
   scan:
     if: github.repository == 'zeek/zeek'

.github/workflows/docker.yml

@@ -18,6 +18,9 @@ env:
   IMAGE_FILE: /tmp/zeek-image.tar
   IMAGE_PATH: /tmp
 
+permissions:
+  contents: read
+
 jobs:
   docker-build:
     runs-on: ubuntu-latest

.github/workflows/generate-docs.yml

@@ -9,8 +9,13 @@ defaults:
   run:
     shell: bash
 
+permissions:
+  contents: read
+
 jobs:
   generate:
+    permissions:
+      contents: write  # for Git to git push
     if: github.repository == 'zeek/zeek'
     runs-on: ubuntu-latest
 

CHANGES

@@ -1,3 +1,19 @@
+5.1.0-dev.27 | 2022-06-14 11:30:28 -0700
+
+  * chore: Set permissions for GitHub actions (naveen)
+
+     Restrict the GitHub token permissions only to the required ones; this way, even if the attackers will succeed in compromising your workflow, they won’t be able to do much.
+
+    - Included permissions for the action. https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions
+
+    https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
+
+    https://docs.github.com/en/actions/using-jobs/assigning-permissions-to-jobs
+
+    [Keeping your GitHub Actions and workflows secure Part 1: Preventing pwn requests](https://securitylab.github.com/research/github-actions-preventing-pwn-requests/)
+
+    Signed-off-by: naveen <172697+naveensrinivasan@users.noreply.github.com>
+
 5.1.0-dev.25 | 2022-06-14 10:07:32 -0700
 
   * chore: Included githubactions in the dependabot config (naveen)

VERSION

@@ -1 +1 @@
-5.1.0-dev.25
+5.1.0-dev.27