Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

CI: Add GitHub token permissions for workflows #36325

Merged
merged 15 commits into from
Dec 16, 2022
Merged

CI: Add GitHub token permissions for workflows #36325

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
15 commits
Select commit Hold shift + click to select a range
ad593ae
ci: add GitHub token permissions
varunsh-coder May 11, 2022
6f6d40f
Merge branch 'main' into token-perms
XhmikosR Nov 12, 2022
4c4a28c
Update issue-close-require.yml
XhmikosR Nov 12, 2022
0ce25b0
Update cspell.yml
XhmikosR Nov 12, 2022
e83f41f
Update issue-close-require.yml
XhmikosR Nov 12, 2022
8ec6bc2
Update cspell.yml
XhmikosR Nov 12, 2022
7d2262f
Update issue-labeled.yml
XhmikosR Nov 12, 2022
392d172
Update issue-close-require.yml
XhmikosR Nov 12, 2022
1adf6f7
Update js.yml
XhmikosR Nov 12, 2022
83a631a
Update release-notes.yml
XhmikosR Nov 12, 2022
f4df7b5
Update cspell.yml
XhmikosR Nov 12, 2022
3a32478
Update js.yml
XhmikosR Nov 12, 2022
d8434af
Update release-notes.yml
XhmikosR Nov 12, 2022
30efdd2
Merge branch 'main' into token-perms
XhmikosR Nov 27, 2022
de93b64
Merge branch 'main' into token-perms
XhmikosR Dec 16, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions .github/workflows/browserstack.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,9 @@ env:
FORCE_COLOR: 2
NODE: 16

permissions:
contents: read

jobs:
browserstack:
runs-on: ubuntu-latest
Expand Down
3 changes: 3 additions & 0 deletions .github/workflows/bundlewatch.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,9 @@ env:
FORCE_COLOR: 2
NODE: 16

permissions:
contents: read

jobs:
bundlewatch:
runs-on: ubuntu-latest
Expand Down
6 changes: 6 additions & 0 deletions .github/workflows/cspell.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,8 +11,14 @@ env:
FORCE_COLOR: 2
NODE: 16

permissions:
contents: read

jobs:
cspell:
permissions:
contents: read # for streetsidesoftware/cspell-action to fetch files for commit
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I wonder, why is this needed since you have specified the same globally?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi @XhmikosR this is needed because there are two permissions specified for that job at the job level. When permissions are specified at the job level, only those listed in the job are provided to the token [1]. So if contents: read is not listed again, the job will only get pull-requests: read.

If no permissions are listed at the job level, it gets the permissions from the workflow level. If the job only needed contents: read, we could have omitted the permissions section at the job level altogether.

Please let me know if you have follow up questions. Thanks!

permissions:
      contents: read  # for streetsidesoftware/cspell-action to fetch files for commit
      pull-requests: read  # for streetsidesoftware/cspell-action to fetch commits for PR

[1] When the permissions key is used, all unspecified permissions are set to no access, with the exception of the metadata scope, which always gets read access. https://docs.github.com/en/actions/security-guides/automatic-token-authentication#modifying-the-permissions-for-the-github_token

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@XhmikosR any update on the pull request review? Please let me know if you have any follow up questions.

pull-requests: read # for streetsidesoftware/cspell-action to fetch commits for PR
runs-on: ubuntu-latest

steps:
Expand Down
3 changes: 3 additions & 0 deletions .github/workflows/css.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,9 @@ env:
FORCE_COLOR: 2
NODE: 16

permissions:
contents: read

jobs:
css:
runs-on: ubuntu-latest
Expand Down
3 changes: 3 additions & 0 deletions .github/workflows/docs.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,9 @@ env:
FORCE_COLOR: 2
NODE: 16

permissions:
contents: read

jobs:
docs:
runs-on: ubuntu-latest
Expand Down
6 changes: 6 additions & 0 deletions .github/workflows/issue-close-require.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,8 +4,14 @@ on:
schedule:
- cron: "0 0 * * *"

permissions:
contents: read

jobs:
issue-close-require:
permissions:
issues: write # for actions-cool/issues-helper to update issues
pull-requests: write # for actions-cool/issues-helper to update PRs
runs-on: ubuntu-latest
if: github.repository == 'twbs/bootstrap'
steps:
Expand Down
6 changes: 6 additions & 0 deletions .github/workflows/issue-labeled.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,8 +4,14 @@ on:
issues:
types: [labeled]

permissions:
contents: read

jobs:
issue-labeled:
permissions:
issues: write # for actions-cool/issues-helper to update issues
pull-requests: write # for actions-cool/issues-helper to update PRs
if: github.repository == 'twbs/bootstrap'
runs-on: ubuntu-latest
steps:
Expand Down
6 changes: 6 additions & 0 deletions .github/workflows/js.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,8 +11,14 @@ env:
FORCE_COLOR: 2
NODE: 16

permissions:
contents: read

jobs:
run:
permissions:
checks: write # for coverallsapp/github-action to create new checks
contents: read # for actions/checkout to fetch code
name: JS Tests
runs-on: ubuntu-latest

Expand Down
3 changes: 3 additions & 0 deletions .github/workflows/lint.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,9 @@ env:
FORCE_COLOR: 2
NODE: 16

permissions:
contents: read

jobs:
lint:
runs-on: ubuntu-latest
Expand Down
3 changes: 3 additions & 0 deletions .github/workflows/node-sass.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,9 @@ env:
FORCE_COLOR: 2
NODE: 16

permissions:
contents: read

jobs:
css:
runs-on: ubuntu-latest
Expand Down
6 changes: 6 additions & 0 deletions .github/workflows/release-notes.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,8 +6,14 @@ on:
- main
workflow_dispatch:

permissions:
contents: read

jobs:
update_release_draft:
permissions:
contents: write # for release-drafter/release-drafter to create a github release
pull-requests: write # for release-drafter/release-drafter to add label to PR
runs-on: ubuntu-latest
if: github.repository == 'twbs/bootstrap'
steps:
Expand Down