chore: Write perms should be as tightly scoped as possible. (#107)

* Add a dependabot file to keep deps up to date

Signed-off-by: Justin Abrahms <[email protected]>

* Move write permissions to the specific job, rather than globally

Signed-off-by: Justin Abrahms <[email protected]>

* Run code scanning (slow auto-build) weekly

Signed-off-by: Justin Abrahms <[email protected]>

Signed-off-by: Justin Abrahms <[email protected]>

Author: justinabrahms

.github/dependabot.yml

@@ -0,0 +1,14 @@
+version: 2
+updates:
+
+  # Maintain dependencies for GitHub Actions
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+
+  # Maintain dependencies for npm
+  - package-ecosystem: "maven"
+    directory: "/"
+    schedule:
+      interval: "weekly"

.github/workflows/merge.yml

@@ -12,13 +12,14 @@ on:
     branches: [ master, main ]
 
 permissions:
-  packages: write
   contents: read
 
 jobs:
   build:
 
     runs-on: ubuntu-latest
+    permissions:
+      packages: write
 
     steps:
     - uses: actions/checkout@v3

.github/workflows/pullrequest.yml

@@ -3,7 +3,6 @@ on:
   pull_request:
     branches: [ master, main ]
 permissions:
-  packages: write
   contents: read
 
 jobs:
@@ -15,6 +14,8 @@ jobs:
         ports:
           - 8013:8013
 
+    permissions:
+      packages: write
     steps:
       - name: Check out the code
         uses: actions/checkout@v3

.github/workflows/static-code-scanning.yaml

@@ -0,0 +1,41 @@
+name: "Code Scanning - Action"
+
+# Docs for this at https://github.com/github/codeql-action#usage
+
+on:
+  schedule:
+    #        ┌───────────── minute (0 - 59)
+    #        │  ┌───────────── hour (0 - 23)
+    #        │  │ ┌───────────── day of the month (1 - 31)
+    #        │  │ │ ┌───────────── month (1 - 12 or JAN-DEC)
+    #        │  │ │ │ ┌───────────── day of the week (0 - 6 or SUN-SAT)
+    #        │  │ │ │ │
+    #        │  │ │ │ │
+    #        │  │ │ │ │
+    #        *  * * * *
+    - cron: '30 1 * * 1'
+
+jobs:
+  CodeQL-Build:
+    # CodeQL runs on ubuntu-latest, windows-latest, and macos-latest
+    runs-on: ubuntu-latest
+
+    permissions:
+      # required for all workflows
+      security-events: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v3
+
+      # Initializes the CodeQL tools for scanning.
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v2
+        with:
+          languages: java
+
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@v2
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v2