From 9b9950335fcec2d8c555ebcf04b361d4d6cc8936 Mon Sep 17 00:00:00 2001 From: Demi Marie Obenour Date: Sat, 28 Mar 2026 12:55:09 -0400 Subject: [PATCH] ci: Run pull_request_target workflows with no permisisons The MSHV tests need access to secrets so that they can run workloads in Azure. It does not need privileged access to GitHub. Ensure its GITHUB_TOKEN has no permissions. Signed-off-by: Demi Marie Obenour --- .github/workflows/mshv-integration.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/mshv-integration.yaml b/.github/workflows/mshv-integration.yaml index 261b84d54..ad544249e 100644 --- a/.github/workflows/mshv-integration.yaml +++ b/.github/workflows/mshv-integration.yaml @@ -1,5 +1,6 @@ name: Cloud Hypervisor Tests (MSHV) (x86_64) on: [pull_request_target, merge_group] +permissions: {} jobs: infra-setup: