Add explicit workflow permissions
| @@ -7,6 +7,10 @@ on: | ||
| 7 | 7 | issue_comment: |
| 8 | 8 | types: [created] |
| 9 | 9 | |
| 10 | +permissions: | |
| 11 | + contents: read | |
| 12 | + issues: write | |
| 13 | + | |
| 10 | 14 | jobs: |
| 11 | 15 | label-on-content: |
| 12 | 16 | name: 🏷️ Label Issues by Content |
| @@ -6,6 +6,10 @@ on: | ||
| 6 | 6 | - staging |
| 7 | 7 | - release |
| 8 | 8 | |
| 9 | +permissions: | |
| 10 | + contents: read | |
| 11 | + issues: write | |
| 12 | + | |
| 9 | 13 | jobs: |
| 10 | 14 | # This runs commits to staging/release, reading the commit messages. Check `pr-auto-manager.yml`:`update-linked-issues` for PR-linked updates. |
| 11 | 15 | update-linked-issues: |
| @@ -6,6 +6,11 @@ on: | ||
| 6 | 6 | schedule: |
| 7 | 7 | - cron: '0 0 * * *' # Runs every day at midnight UTC |
| 8 | 8 | |
| 9 | +permissions: | |
| 10 | + contents: read | |
| 11 | + issues: write | |
| 12 | + pull-requests: write | |
| 13 | + | |
| 9 | 14 | jobs: |
| 10 | 15 | mark-inactivity: |
| 11 | 16 | name: ⏳ Mark Issues/PRs without Activity |
| @@ -6,6 +6,11 @@ on: | ||
| 6 | 6 | pull_request_target: |
| 7 | 7 | types: [closed] |
| 8 | 8 | |
| 9 | +permissions: | |
| 10 | + contents: read | |
| 11 | + issues: write | |
| 12 | + pull-requests: write | |
| 13 | + | |
| 9 | 14 | jobs: |
| 10 | 15 | remove-labels: |
| 11 | 16 | name: 🗑️ Remove Pending Labels on Close |
| @@ -6,6 +6,11 @@ on: | ||
| 6 | 6 | pull_request_target: |
| 7 | 7 | types: [opened] |
| 8 | 8 | |
| 9 | +permissions: | |
| 10 | + contents: read | |
| 11 | + issues: write | |
| 12 | + pull-requests: write | |
| 13 | + | |
| 9 | 14 | jobs: |
| 10 | 15 | label-maintainer: |
| 11 | 16 | name: 🏷️ Label if Author is a Repo Maintainer |
| @@ -6,6 +6,10 @@ on: | ||
| 6 | 6 | pull_request_review_comment: |
| 7 | 7 | types: [created] |
| 8 | 8 | |
| 9 | +permissions: | |
| 10 | + contents: read | |
| 11 | + pull-requests: write | |
| 12 | + | |
| 9 | 13 | jobs: |
| 10 | 14 | label-by-size: |
| 11 | 15 | name: 🏷️ Label PR by Size |
| @@ -75,7 +79,7 @@ jobs: | ||
| 75 | 79 | name: 🗑️ Remove Stale Label on Comment |
| 76 | 80 | runs-on: ubuntu-latest |
| 77 | 81 | # Only runs when this is not done by the github actions bot |
| 78 | 82 | if: github.event_name == 'pull_request_review_comment' && github.actor != 'github-actions[bot]' |
| 79 | 83 | |
| 80 | 84 | steps: |
| 81 | 85 | - name: Remove Stale Label |
| @@ -95,6 +99,12 @@ jobs: | ||
| 95 | 99 | # Run, even if the previous jobs were skipped/failed |
| 96 | 100 | if: always() |
| 97 | 101 | |
| 102 | + # Override permissions, as this needs to write a check | |
| 103 | + permissions: | |
| 104 | + checks: write | |
| 105 | + contents: read | |
| 106 | + pull-requests: read | |
| 107 | + | |
| 98 | 108 | steps: |
| 99 | 109 | - name: Check Merge Blocking |
| 100 | 110 | # GitHub Script |
| @@ -7,6 +7,10 @@ on: | ||
| 7 | 7 | pull_request_target: |
| 8 | 8 | types: [synchronize] |
| 9 | 9 | |
| 10 | +permissions: | |
| 11 | + contents: read | |
| 12 | + pull-requests: write | |
| 13 | + | |
| 10 | 14 | jobs: |
| 11 | 15 | check-merge-conflicts: |
| 12 | 16 | name: ⚔️ Check Merge Conflicts |