Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commitafacb07

Browse files
authored
chore: tighten GitHub workflow permissions (#15282)
1 parentdf6afd3 commitafacb07

File tree

7 files changed

+41
-17
lines changed

7 files changed

+41
-17
lines changed

‎.github/workflows/docker-base.yaml‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -22,17 +22,18 @@ on:
2222

2323
permissions:
2424
contents:read
25-
# Necessary to push docker images to ghcr.io.
26-
packages:write
27-
# Necessary for depot.dev authentication.
28-
id-token:write
2925

3026
# Avoid running multiple jobs for the same commit.
3127
concurrency:
3228
group:${{ github.workflow }}-${{ github.ref }}-docker-base
3329

3430
jobs:
3531
build:
32+
permissions:
33+
# Necessary for depot.dev authentication.
34+
id-token:write
35+
# Necessary to push docker images to ghcr.io.
36+
packages:write
3637
runs-on:ubuntu-latest
3738
if:github.repository_owner == 'coder'
3839
steps:

‎.github/workflows/nightly-gauntlet.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,10 @@ on:
66
# Every day at midnight
77
-cron:"0 0 * * *"
88
workflow_dispatch:
9+
10+
permissions:
11+
contents:read
12+
913
jobs:
1014
go-race:
1115
# While GitHub's toaster runners are likelier to flake, we want consistency

‎.github/workflows/pr-cleanup.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,12 +8,12 @@ on:
88
description:"PR number"
99
required:true
1010

11-
permissions:
12-
packages:write
13-
1411
jobs:
1512
cleanup:
1613
runs-on:"ubuntu-latest"
14+
permissions:
15+
# Necessary to delete docker images from ghcr.io.
16+
packages:write
1717
steps:
1818
-name:Harden Runner
1919
uses:step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7# v2.10.1

‎.github/workflows/pr-deploy.yaml‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -30,8 +30,6 @@ env:
3030

3131
permissions:
3232
contents:read
33-
packages:write
34-
pull-requests:write# needed for commenting on PRs
3533

3634
jobs:
3735
check_pr:
@@ -171,6 +169,8 @@ jobs:
171169
needs:get_info
172170
if:needs.get_info.outputs.BUILD == 'true' || github.event.inputs.deploy == 'true'
173171
runs-on:"ubuntu-latest"
172+
permissions:
173+
pull-requests:write# needed for commenting on PRs
174174
steps:
175175
-name:Harden Runner
176176
uses:step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7# v2.10.1
@@ -205,6 +205,9 @@ jobs:
205205
# Run build job only if there are changes in the files that we care about or if the workflow is manually triggered with --build flag
206206
if:needs.get_info.outputs.BUILD == 'true'
207207
runs-on:${{ github.repository_owner == 'coder' && 'depot-ubuntu-22.04-8' || 'ubuntu-latest' }}
208+
permissions:
209+
# Necessary to push docker images to ghcr.io.
210+
packages:write
208211
# This concurrency only cancels build jobs if a new build is triggred. It will avoid cancelling the current deployemtn in case of docs chnages.
209212
concurrency:
210213
group:build-${{ github.workflow }}-${{ github.ref }}-${{ needs.get_info.outputs.BUILD }}

‎.github/workflows/release-validation.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,9 @@ on:
55
tags:
66
-"v*"
77

8+
permissions:
9+
contents:read
10+
811
jobs:
912
network-performance:
1013
runs-on:ubuntu-latest

‎.github/workflows/release.yaml‎

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -18,12 +18,7 @@ on:
1818
default:false
1919

2020
permissions:
21-
# Required to publish a release
22-
contents:write
23-
# Necessary to push docker images to ghcr.io.
24-
packages:write
25-
# Necessary for GCP authentication (https://github.com/google-github-actions/setup-gcloud#usage)
26-
id-token:write
21+
contents:read
2722

2823
concurrency:${{ github.workflow }}-${{ github.ref }}
2924

@@ -40,6 +35,13 @@ jobs:
4035
release:
4136
name:Build and publish
4237
runs-on:${{ github.repository_owner == 'coder' && 'depot-ubuntu-22.04-8' || 'ubuntu-latest' }}
38+
permissions:
39+
# Required to publish a release
40+
contents:write
41+
# Necessary to push docker images to ghcr.io.
42+
packages:write
43+
# Necessary for GCP authentication (https://github.com/google-github-actions/setup-gcloud#usage)
44+
id-token:write
4345
env:
4446
# Necessary for Docker manifest
4547
DOCKER_CLI_EXPERIMENTAL:"enabled"

‎.github/workflows/stale.yaml‎

Lines changed: 13 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,21 @@
1-
name:Stale Issue,Banch and Old Workflows Cleanup
1+
name:Stale Issue,Branch and Old Workflows Cleanup
22
on:
33
schedule:
44
# Every day at midnight
55
-cron:"0 0 * * *"
66
workflow_dispatch:
7+
8+
permissions:
9+
contents:read
10+
711
jobs:
812
issues:
913
runs-on:ubuntu-latest
1014
permissions:
15+
# Needed to close issues.
1116
issues:write
17+
# Needed to close PRs.
1218
pull-requests:write
13-
actions:write
1419
steps:
1520
-name:Harden Runner
1621
uses:step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7# v2.10.1
@@ -86,6 +91,9 @@ jobs:
8691
8792
branches:
8893
runs-on:ubuntu-latest
94+
permissions:
95+
# Needed to delete branches.
96+
contents:write
8997
steps:
9098
-name:Harden Runner
9199
uses:step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7# v2.10.1
@@ -105,6 +113,9 @@ jobs:
105113
exclude_open_pr_branches:true
106114
del_runs:
107115
runs-on:ubuntu-latest
116+
permissions:
117+
# Needed to delete workflow runs.
118+
actions:write
108119
steps:
109120
-name:Harden Runner
110121
uses:step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7# v2.10.1

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp