From f4b73525a44efbf29db9791fa969deaa8d95458c Mon Sep 17 00:00:00 2001
From: Alex <aleksandrosansan@gmail.com>
Date: Fri, 23 Sep 2022 13:01:08 +0200
Subject: [PATCH] build: harden render_nanomaps.yml permissions

Signed-off-by: Alex <aleksandrosansan@gmail.com>
---
 .github/workflows/render_nanomaps.yml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/.github/workflows/render_nanomaps.yml b/.github/workflows/render_nanomaps.yml
index 57f305772c..d6f2622041 100644
--- a/.github/workflows/render_nanomaps.yml
+++ b/.github/workflows/render_nanomaps.yml
@@ -11,8 +11,13 @@ on:
     paths:
       - 'maps/**'
 
+permissions: {}
 jobs:
   generate_maps:
+    permissions:
+      contents: write # to push to branch
+      pull-requests: write # to create pull requests (repo-sync/pull-request)
+
     name: 'Generate NanoMaps'
     runs-on: ubuntu-latest
     steps: