build: harden create_feedstocks.yml permissions
@@ -8,8 +8,13 @@ on:
- cron: '*/10 * * * *'
workflow_dispatch: null
+permissions: {}
jobs:
create-feedstocks:
+ permissions:
+ contents: write # for git push
+ actions: read # to read runs
+
if: github.repository == 'conda-forge/staged-recipes'
name: Create feedstocks
runs-on: ubuntu-latest
