From 9759eba98671dc6f5b1d18e039055da32c888645 Mon Sep 17 00:00:00 2001 From: Fleny Date: Thu, 21 Aug 2025 04:07:49 +0200 Subject: [PATCH] ci: Specify permissions for CI (#4338) Co-authored-by: Link --- .github/workflows/benchmark.yml | 5 ++++- .github/workflows/commentBenchResult.yml | 5 ++++- .github/workflows/docker-app-rest-passthrough.yml | 10 +++++++++- .github/workflows/e2e-test.yml | 3 ++- .github/workflows/integration-test.yml | 3 ++- .github/workflows/labeler.yml | 4 +++- .github/workflows/lib-check-e2e.yml | 3 ++- .github/workflows/lib-check.yml | 3 ++- .github/workflows/other-runtime-unit-test.yml | 3 ++- .github/workflows/release.yml | 9 ++++----- .github/workflows/retryBenchmark.yml | 3 ++- .github/workflows/site.yml | 14 ++++++++------ .github/workflows/stale.yml | 8 +++----- .github/workflows/unit-test.yml | 3 ++- 14 files changed, 49 insertions(+), 27 deletions(-) diff --git a/.github/workflows/benchmark.yml b/.github/workflows/benchmark.yml index 3d6d76b4f..7f0dc51e6 100644 --- a/.github/workflows/benchmark.yml +++ b/.github/workflows/benchmark.yml @@ -1,5 +1,8 @@ name: Benchmark - +permissions: + contents: write + deployments: write + actions: write on: workflow_call: inputs: diff --git a/.github/workflows/commentBenchResult.yml b/.github/workflows/commentBenchResult.yml index 736ce0e1e..40959fcfb 100644 --- a/.github/workflows/commentBenchResult.yml +++ b/.github/workflows/commentBenchResult.yml @@ -1,5 +1,8 @@ name: Comment Benchmark Result - +permissions: + contents: read + actions: read + pull-requests: write on: workflow_run: workflows: [Benchmark with retry] diff --git a/.github/workflows/docker-app-rest-passthrough.yml b/.github/workflows/docker-app-rest-passthrough.yml index 2542cc370..2bb71db30 100644 --- a/.github/workflows/docker-app-rest-passthrough.yml +++ b/.github/workflows/docker-app-rest-passthrough.yml @@ -1,5 +1,6 @@ name: Docker App - Rest Passthrough - +permissions: + contents: read on: push: branches: @@ -50,6 +51,9 @@ jobs: name: Build docker image runs-on: ubuntu-latest needs: app-version + permissions: + contents: read + actions: write steps: - uses: actions/checkout@v4 - name: Cache Docker layers @@ -90,6 +94,10 @@ jobs: name: Image scan runs-on: ubuntu-latest needs: build + permissions: + contents: read + security-events: write + actions: read steps: - uses: actions/checkout@v4 - name: Set up Docker Buildx diff --git a/.github/workflows/e2e-test.yml b/.github/workflows/e2e-test.yml index 90a2b874e..cd1a5b7b8 100644 --- a/.github/workflows/e2e-test.yml +++ b/.github/workflows/e2e-test.yml @@ -1,5 +1,6 @@ name: E2E Test - +permissions: + contents: read on: workflow_call: inputs: diff --git a/.github/workflows/integration-test.yml b/.github/workflows/integration-test.yml index 9265c5c83..2bea7bbb3 100644 --- a/.github/workflows/integration-test.yml +++ b/.github/workflows/integration-test.yml @@ -1,5 +1,6 @@ name: Package Test - +permissions: + contents: read on: workflow_call: inputs: diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml index f7ae10c3b..3356174dc 100644 --- a/.github/workflows/labeler.yml +++ b/.github/workflows/labeler.yml @@ -1,5 +1,7 @@ name: Labeler - +permissions: + issues: write + pull-requests: write on: pull_request_target: types: ['edited', 'opened', 'reopened', 'synchronize'] diff --git a/.github/workflows/lib-check-e2e.yml b/.github/workflows/lib-check-e2e.yml index 70f5a4379..8e07a567b 100644 --- a/.github/workflows/lib-check-e2e.yml +++ b/.github/workflows/lib-check-e2e.yml @@ -1,5 +1,6 @@ name: Library Checks (E2E) - +permissions: + contents: read on: pull_request: push: diff --git a/.github/workflows/lib-check.yml b/.github/workflows/lib-check.yml index 5129f83e1..aec36df73 100644 --- a/.github/workflows/lib-check.yml +++ b/.github/workflows/lib-check.yml @@ -1,5 +1,6 @@ name: Library Checks - +permissions: + contents: read on: pull_request: push: diff --git a/.github/workflows/other-runtime-unit-test.yml b/.github/workflows/other-runtime-unit-test.yml index 292320faa..5f3d4ea7a 100644 --- a/.github/workflows/other-runtime-unit-test.yml +++ b/.github/workflows/other-runtime-unit-test.yml @@ -1,5 +1,6 @@ name: Other Runtime Package Test - +permissions: + contents: read on: workflow_call: inputs: diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 210173f20..c7639a9a7 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -1,5 +1,8 @@ name: Release - +permissions: + contents: read + packages: write + id-token: write on: push: branches: @@ -14,10 +17,6 @@ on: jobs: publish: runs-on: ubuntu-latest - permissions: - contents: read - packages: write - id-token: write strategy: fail-fast: false matrix: diff --git a/.github/workflows/retryBenchmark.yml b/.github/workflows/retryBenchmark.yml index 6d1b7d8dc..1b5f8399e 100644 --- a/.github/workflows/retryBenchmark.yml +++ b/.github/workflows/retryBenchmark.yml @@ -1,5 +1,6 @@ name: Benchmark with retry - +permissions: + contents: read on: pull_request: paths-ignore: diff --git a/.github/workflows/site.yml b/.github/workflows/site.yml index 75b3b4092..54f01aab0 100644 --- a/.github/workflows/site.yml +++ b/.github/workflows/site.yml @@ -1,5 +1,6 @@ name: Deploy Docs Site - +permissions: + contents: read on: push: branches: ['main'] @@ -12,15 +13,13 @@ on: pull_request: workflow_dispatch: -permissions: - contents: read - pages: write - id-token: write - jobs: build: name: Build Docusaurus runs-on: ubuntu-latest + permissions: + contents: read + actions: write steps: - uses: actions/checkout@v4 - uses: actions/setup-node@v4 @@ -81,6 +80,9 @@ jobs: needs: build if: github.event_name == 'push' || github.event_name == 'workflow_dispatch' concurrency: deploy-site + permissions: + pages: write + id-token: write steps: - name: Deploy to GitHub Pages id: deployment diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml index 3784def06..558e56d2b 100644 --- a/.github/workflows/stale.yml +++ b/.github/workflows/stale.yml @@ -4,7 +4,9 @@ # For more information, see: # https://github.com/actions/stale name: Mark stale issues and pull requests - +permissions: + issues: write + pull-requests: write on: schedule: - cron: '0 0 * * 1' @@ -12,10 +14,6 @@ on: jobs: stale: runs-on: ubuntu-latest - permissions: - issues: write - pull-requests: write - steps: - uses: actions/stale@v9 with: diff --git a/.github/workflows/unit-test.yml b/.github/workflows/unit-test.yml index bee43be12..4f87c3788 100644 --- a/.github/workflows/unit-test.yml +++ b/.github/workflows/unit-test.yml @@ -1,5 +1,6 @@ name: Package Test - +permissions: + contents: read on: workflow_call: inputs: