ci: move write permissions to job level in cherrypick workflow (#3219)

Signed-off-by: Shahar Harari <shahar.harari@sap.com>
envoyproxy · Apr 19, 2024 · b69b872 · b69b872
1 parent e1a3ab4
commit b69b872
Showing 1 changed file with 4 additions and 2 deletions.
diff --git a/.github/workflows/cherrypick.yaml b/.github/workflows/cherrypick.yaml
@@ -6,11 +6,13 @@ on:
     types: ["closed"]
 
 permissions:
-  pull-requests: write
-  contents: write
+  contents: read
 
 jobs:
   cherry_pick_release_v1_0:
+    permissions:
+      pull-requests: write
+      contents: write
     runs-on: ubuntu-22.04
     name: Cherry pick into release-v1.0
     if: ${{ contains(github.event.pull_request.labels.*.name, 'cherrypick/release-v1.0') && github.event.pull_request.merged == true }}