Skip to content

Commit

Permalink
ci: Drop workflow permissions
Browse files Browse the repository at this point in the history
  • Loading branch information
yiannistri committed Oct 3, 2023
1 parent 81c0ed6 commit e2c168e
Show file tree
Hide file tree
Showing 5 changed files with 20 additions and 5 deletions.
6 changes: 3 additions & 3 deletions .github/workflows/chart.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -18,9 +18,7 @@ env:
CHART_LOCATION: weaveworks/charts

permissions:
contents: write
id-token: write
packages: write
contents: read # for actions/checkout to fetch code

jobs:
helm-new-version:
Expand Down Expand Up @@ -80,6 +78,8 @@ jobs:
runs-on: ubuntu-latest
needs: helm-new-version
if: (github.event_name == 'push' && needs.helm-new-version.outputs.old-version != needs.helm-new-version.outputs.new-version) || github.event_name == 'workflow_dispatch'
permissions:
packages: write # needed for ghcr access
steps:
- uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
- name: Find new version
Expand Down
4 changes: 3 additions & 1 deletion .github/workflows/docs.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -13,8 +13,10 @@ on:
- 'website/**'
workflow_dispatch:

jobs:
permissions:
contents: read # for actions/checkout to fetch code

jobs:
staging-release:
permissions:
statuses: write
Expand Down
3 changes: 3 additions & 0 deletions .github/workflows/pr.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,9 @@ on:
- main
workflow_dispatch:

permissions:
contents: read # for actions/checkout to fetch code

env:
CI_CONTAINER_REGISTRY: europe-west1-docker.pkg.dev
CI_CONTAINER_REPOSITORY: europe-west1-docker.pkg.dev/weave-gitops-clusters/weave-gitops
Expand Down
3 changes: 3 additions & 0 deletions .github/workflows/prepare-release.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,9 @@ on:
description: "Version (e.g. 'v1.2.3-rc.4')"
required: true

permissions:
contents: read # for actions/checkout to fetch code
pull-requests: read # for mikepenz/release-changelog-builder-action to create changelog
env:
REGISTRY: ghcr.io
IMAGE_NAME: weaveworks/wego-app
Expand Down
9 changes: 8 additions & 1 deletion .github/workflows/release.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,9 @@ on:
types:
- submitted

permissions:
contents: read # for actions/checkout to fetch code

env:
REGISTRY: ghcr.io
IMAGE_NAME: weaveworks/wego-app
Expand All @@ -15,6 +18,8 @@ jobs:
runs-on: ubuntu-latest
outputs:
version: ${{ steps.release-version.outputs.version }}
permissions:
contents: write # for action to git push a tag
steps:
- name: Checkout
uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
Expand All @@ -37,6 +42,8 @@ jobs:
publish_npm_package:
needs: tag-release
runs-on: ubuntu-latest
permissions:
packages: write # needed for GitHub Packages registry access
steps:
- name: Checkout
uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
Expand All @@ -51,11 +58,11 @@ jobs:
- run: make ui-lib && cd dist && npm publish
env:
NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

build-and-push-image:
needs: tag-release
runs-on: ubuntu-latest
permissions:
contents: read
packages: write
steps:
- name: Checkout
Expand Down

0 comments on commit e2c168e

Please sign in to comment.