Add explicit workflow permissions

0126e5e5a3bf48a36156e18026dfa183c8250989

Wolfsblvt <wolfsblvt@gmail.com>

Parents: d8c8bfa8a43f34ba02ff421fc8adcc8376daff61
7 files changed, +38 -1Showing whitespace changes
.github/workflows/issues-auto-manager.yml+4 -0
@@ -7,6 +7,10 @@ on:
7 issue_comment:7 issue_comment:
8 types: [created]8 types: [created]
99
10permissions:
11 contents: read
12 issues: write
13
10jobs:14jobs:
11 label-on-content:15 label-on-content:
12 name: 🏷️ Label Issues by Content16 name: 🏷️ Label Issues by Content
.github/workflows/issues-updates-on-merge.yml+4 -0
@@ -6,6 +6,10 @@ on:
6 - staging6 - staging
7 - release7 - release
88
9permissions:
10 contents: read
11 issues: write
12
9jobs:13jobs:
10 # This runs commits to staging/release, reading the commit messages. Check `pr-auto-manager.yml`:`update-linked-issues` for PR-linked updates.14 # This runs commits to staging/release, reading the commit messages. Check `pr-auto-manager.yml`:`update-linked-issues` for PR-linked updates.
11 update-linked-issues:15 update-linked-issues:
.github/workflows/job-close-stale.yml+5 -0
@@ -6,6 +6,11 @@ on:
6 schedule:6 schedule:
7 - cron: '0 0 * * *' # Runs every day at midnight UTC7 - cron: '0 0 * * *' # Runs every day at midnight UTC
88
9permissions:
10 contents: read
11 issues: write
12 pull-requests: write
13
9jobs:14jobs:
10 mark-inactivity:15 mark-inactivity:
11 name: ⏳ Mark Issues/PRs without Activity16 name: ⏳ Mark Issues/PRs without Activity
.github/workflows/on-close-handler.yml+5 -0
@@ -6,6 +6,11 @@ on:
6 pull_request_target:6 pull_request_target:
7 types: [closed]7 types: [closed]
88
9permissions:
10 contents: read
11 issues: write
12 pull-requests: write
13
9jobs:14jobs:
10 remove-labels:15 remove-labels:
11 name: 🗑️ Remove Pending Labels on Close16 name: 🗑️ Remove Pending Labels on Close
.github/workflows/on-open-handler.yml+5 -0
@@ -6,6 +6,11 @@ on:
6 pull_request_target:6 pull_request_target:
7 types: [opened]7 types: [opened]
88
9permissions:
10 contents: read
11 issues: write
12 pull-requests: write
13
9jobs:14jobs:
10 label-maintainer:15 label-maintainer:
11 name: 🏷️ Label if Author is a Repo Maintainer16 name: 🏷️ Label if Author is a Repo Maintainer
.github/workflows/pr-auto-manager.yml+11 -1
@@ -6,6 +6,10 @@ on:
6 pull_request_review_comment:6 pull_request_review_comment:
7 types: [created]7 types: [created]
88
9permissions:
10 contents: read
11 pull-requests: write
12
9jobs:13jobs:
10 label-by-size:14 label-by-size:
11 name: 🏷️ Label PR by Size15 name: 🏷️ Label PR by Size
@@ -75,7 +79,7 @@ jobs:
75 name: 🗑️ Remove Stale Label on Comment79 name: 🗑️ Remove Stale Label on Comment
76 runs-on: ubuntu-latest80 runs-on: ubuntu-latest
77 # Only runs when this is not done by the github actions bot81 # Only runs when this is not done by the github actions bot
78 if: github.actor != 'github-actions[bot]'82 if: github.event_name == 'pull_request_review_comment' && github.actor != 'github-actions[bot]'
7983
80 steps:84 steps:
81 - name: Remove Stale Label85 - name: Remove Stale Label
@@ -95,6 +99,12 @@ jobs:
95 # Run, even if the previous jobs were skipped/failed99 # Run, even if the previous jobs were skipped/failed
96 if: always()100 if: always()
97101
102 # Override permissions, as this needs to write a check
103 permissions:
104 checks: write
105 contents: read
106 pull-requests: read
107
98 steps:108 steps:
99 - name: Check Merge Blocking109 - name: Check Merge Blocking
100 # GitHub Script110 # GitHub Script
.github/workflows/pr-check-merge-conflicts.yaml+4 -0
@@ -7,6 +7,10 @@ on:
7 pull_request_target:7 pull_request_target:
8 types: [synchronize]8 types: [synchronize]
99
10permissions:
11 contents: read
12 pull-requests: write
13
10jobs:14jobs:
11 check-merge-conflicts:15 check-merge-conflicts:
12 name: ⚔️ Check Merge Conflicts16 name: ⚔️ Check Merge Conflicts