Skip to content

Commit 0ce680c

Browse files
bkoelmanbkoelman
authored
Merge pull request #1322 from json-api-dotnet/github-actions-permissions
GitHub Actions: reduce permissions
2 parents 9bdcf33 + f55da1f commit 0ce680c

File tree

1 file changed

+87
-81
lines changed

1 file changed

+87
-81
lines changed

‎.github/workflows/build.yml

+87-81
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,8 @@ jobs:
3535
matrix:
3636
os: [ubuntu-latest, windows-latest, macos-latest]
3737
runs-on: ${{ matrix.os }}
38+
permissions:
39+
contents: read
3840
steps:
3941
- name: Setup PostgreSQL
4042
uses: ikalnytskyi/action-setup-postgres@v4
@@ -146,93 +148,97 @@ jobs:
146148
path: docs/_site
147149

148150
inspect-code:
149-
timeout-minutes: 60
150-
strategy:
151-
fail-fast: false
152-
matrix:
153-
os: [ubuntu-latest, windows-latest, macos-latest]
154-
runs-on: ${{ matrix.os }}
155-
steps:
156-
- name: Git checkout
157-
uses: actions/checkout@v3
158-
- name: Setup .NET
159-
uses: actions/setup-dotnet@v3
160-
with:
161-
dotnet-version: 6.0.x
162-
- name: Restore tools
163-
run: |
164-
dotnet tool restore
165-
- name: InspectCode
166-
shell: pwsh
167-
run: |
168-
$inspectCodeOutputPath = Join-Path $env:RUNNER_TEMP 'jetbrains-inspectcode-results.xml'
169-
Write-Output "INSPECT_CODE_OUTPUT_PATH=$inspectCodeOutputPath" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
170-
dotnet jb inspectcode JsonApiDotNetCore.sln --build --output="$inspectCodeOutputPath" --profile=WarningSeverities.DotSettings --properties:Configuration=Release --properties:ContinuousIntegrationBuild=false --severity=WARNING --verbosity=WARN -dsl=GlobalAll -dsl=GlobalPerProduct -dsl=SolutionPersonal -dsl=ProjectPersonal
171-
- name: Verify outcome
172-
shell: pwsh
173-
run: |
174-
[xml]$xml = Get-Content $env:INSPECT_CODE_OUTPUT_PATH
175-
if ($xml.report.Issues -and $xml.report.Issues.Project) {
176-
foreach ($project in $xml.report.Issues.Project) {
177-
if ($project.Issue.Count -gt 0) {
178-
$project.ForEach({
179-
Write-Output "`nProject $($project.Name)"
180-
$failed = $true
151+
timeout-minutes: 60
152+
strategy:
153+
fail-fast: false
154+
matrix:
155+
os: [ubuntu-latest, windows-latest, macos-latest]
156+
runs-on: ${{ matrix.os }}
157+
permissions:
158+
contents: read
159+
steps:
160+
- name: Git checkout
161+
uses: actions/checkout@v3
162+
- name: Setup .NET
163+
uses: actions/setup-dotnet@v3
164+
with:
165+
dotnet-version: 6.0.x
166+
- name: Restore tools
167+
run: |
168+
dotnet tool restore
169+
- name: InspectCode
170+
shell: pwsh
171+
run: |
172+
$inspectCodeOutputPath = Join-Path $env:RUNNER_TEMP 'jetbrains-inspectcode-results.xml'
173+
Write-Output "INSPECT_CODE_OUTPUT_PATH=$inspectCodeOutputPath" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
174+
dotnet jb inspectcode JsonApiDotNetCore.sln --build --output="$inspectCodeOutputPath" --profile=WarningSeverities.DotSettings --properties:Configuration=Release --properties:ContinuousIntegrationBuild=false --severity=WARNING --verbosity=WARN -dsl=GlobalAll -dsl=GlobalPerProduct -dsl=SolutionPersonal -dsl=ProjectPersonal
175+
- name: Verify outcome
176+
shell: pwsh
177+
run: |
178+
[xml]$xml = Get-Content $env:INSPECT_CODE_OUTPUT_PATH
179+
if ($xml.report.Issues -and $xml.report.Issues.Project) {
180+
foreach ($project in $xml.report.Issues.Project) {
181+
if ($project.Issue.Count -gt 0) {
182+
$project.ForEach({
183+
Write-Output "`nProject $($project.Name)"
184+
$failed = $true
181185
182-
$_.Issue.ForEach({
183-
$issueType = $xml.report.IssueTypes.SelectSingleNode("IssueType[@Id='$($_.TypeId)']")
184-
$severity = $_.Severity ?? $issueType.Severity
186+
$_.Issue.ForEach({
187+
$issueType = $xml.report.IssueTypes.SelectSingleNode("IssueType[@Id='$($_.TypeId)']")
188+
$severity = $_.Severity ?? $issueType.Severity
185189
186-
Write-Output "[$severity] $($_.File):$($_.Line) $($_.TypeId): $($_.Message)"
187-
})
188-
})
189-
}
190-
}
190+
Write-Output "[$severity] $($_.File):$($_.Line) $($_.TypeId): $($_.Message)"
191+
})
192+
})
193+
}
194+
}
191195
192-
if ($failed) {
193-
Write-Error "One or more projects failed code inspection."
194-
}
195-
}
196+
if ($failed) {
197+
Write-Error "One or more projects failed code inspection."
198+
}
199+
}
196200
197201
cleanup-code:
198-
timeout-minutes: 60
199-
strategy:
200-
fail-fast: false
201-
matrix:
202-
os: [ubuntu-latest, windows-latest, macos-latest]
203-
runs-on: ${{ matrix.os }}
204-
steps:
205-
- name: Git checkout
206-
uses: actions/checkout@v3
207-
with:
208-
fetch-depth: 2
209-
- name: Setup .NET
210-
uses: actions/setup-dotnet@v3
211-
with:
212-
dotnet-version: 6.0.x
213-
- name: Restore tools
214-
run: |
215-
dotnet tool restore
216-
- name: Restore packages
217-
run: |
218-
dotnet restore
219-
- name: CleanupCode (on PR diff)
220-
if: github.event_name == 'pull_request'
221-
shell: pwsh
222-
run: |
223-
# Not using the environment variables for SHAs, because they may be outdated. This may happen on force-push after the build is queued, but before it starts.
224-
# The below works because HEAD is detached (at the merge commit), so HEAD~1 is at the base branch. When a PR contains no commits, this job will not run.
225-
$headCommitHash = git rev-parse HEAD
226-
$baseCommitHash = git rev-parse HEAD~1
202+
timeout-minutes: 60
203+
strategy:
204+
fail-fast: false
205+
matrix:
206+
os: [ubuntu-latest, windows-latest, macos-latest]
207+
runs-on: ${{ matrix.os }}
208+
permissions:
209+
contents: read
210+
steps:
211+
- name: Git checkout
212+
uses: actions/checkout@v3
213+
with:
214+
fetch-depth: 2
215+
- name: Setup .NET
216+
uses: actions/setup-dotnet@v3
217+
with:
218+
dotnet-version: 6.0.x
219+
- name: Restore tools
220+
run: |
221+
dotnet tool restore
222+
- name: Restore packages
223+
run: |
224+
dotnet restore
225+
- name: CleanupCode (on PR diff)
226+
if: github.event_name == 'pull_request'
227+
shell: pwsh
228+
run: |
229+
# Not using the environment variables for SHAs, because they may be outdated. This may happen on force-push after the build is queued, but before it starts.
230+
# The below works because HEAD is detached (at the merge commit), so HEAD~1 is at the base branch. When a PR contains no commits, this job will not run.
231+
$headCommitHash = git rev-parse HEAD
232+
$baseCommitHash = git rev-parse HEAD~1
227233
228-
Write-Output "Running code cleanup on commit range $baseCommitHash..$headCommitHash in pull request."
229-
dotnet regitlint -s JsonApiDotNetCore.sln --print-command --skip-tool-check --max-runs=5 --jb-profile="JADNC Full Cleanup" --jb --properties:Configuration=Release --jb --verbosity=WARN -f commits -a $headCommitHash -b $baseCommitHash --fail-on-diff --print-diff
230-
- name: CleanupCode (on branch)
231-
if: github.event_name == 'push'
232-
shell: pwsh
233-
run: |
234-
Write-Output "Running code cleanup on all files."
235-
dotnet regitlint -s JsonApiDotNetCore.sln --print-command --skip-tool-check --jb-profile="JADNC Full Cleanup" --jb --properties:Configuration=Release --jb --verbosity=WARN --fail-on-diff --print-diff
234+
Write-Output "Running code cleanup on commit range $baseCommitHash..$headCommitHash in pull request."
235+
dotnet regitlint -s JsonApiDotNetCore.sln --print-command --skip-tool-check --max-runs=5 --jb-profile="JADNC Full Cleanup" --jb --properties:Configuration=Release --jb --verbosity=WARN -f commits -a $headCommitHash -b $baseCommitHash --fail-on-diff --print-diff
236+
- name: CleanupCode (on branch)
237+
if: github.event_name == 'push'
238+
shell: pwsh
239+
run: |
240+
Write-Output "Running code cleanup on all files."
241+
dotnet regitlint -s JsonApiDotNetCore.sln --print-command --skip-tool-check --jb-profile="JADNC Full Cleanup" --jb --properties:Configuration=Release --jb --verbosity=WARN --fail-on-diff --print-diff
236242
237243
publish:
238244
timeout-minutes: 60

0 commit comments

Comments
 (0)