Set minimal tokens for auto_approve_pr (#14534)

Signed-off-by: Pedro Kaj Kjellerup Nacht <[email protected]>
vitessio · Nov 27, 2023 · 61a0f02 · 61a0f02
1 parent 4ddce5f
commit 61a0f02
Showing 1 changed file with 7 additions and 1 deletion.
diff --git a/.github/workflows/auto_approve_pr.yml b/.github/workflows/auto_approve_pr.yml
@@ -3,14 +3,20 @@ on:
   pull_request:
     types: [opened, reopened]
 
+permissions:
+  contents: read
+
 jobs:
   auto_approve:
     name: Auto Approve Pull Request
     runs-on: ubuntu-latest
+
+    permissions:
+      pull-requests: write  # only given on local PRs, forks run with `read` access
+
     steps:
       - name: Checkout code
         uses: actions/checkout@v3
-
       - name: Auto Approve Pull Request
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}