Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ci: reduce the permissions for github actions jobs #375

Merged
merged 9 commits into from
Dec 13, 2024
Merged

ci: reduce the permissions for github actions jobs #375

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
d7da059
ci: avoid persisting git credentials between steps in a job
zimeg Dec 12, 2024
0e1e878
ci(temp): remove all permissions from action jobs
zimeg Dec 13, 2024
5b7f214
ci(fix): reintroduce the write check to tests
zimeg Dec 13, 2024
bbbd64c
ci: use default permissions in the devlopment workflow
zimeg Dec 13, 2024
e49fb07
ci(fix): use a separate api token with codecov
zimeg Dec 13, 2024
d631cfa
chore: tag a release candidate
zimeg Dec 13, 2024
b563ce2
ci(fix): publish and write contents to the repo
zimeg Dec 13, 2024
85d7bb5
chore: tag a release candidate
zimeg Dec 13, 2024
d584e53
revert: undo release candidatees for the pr
zimeg Dec 13, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions .github/workflows/develop.yml
View file
Open in desktop
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

IMO the default permissions are alright on a "development" workflow that's only run for experimenting with changes 🔍

Open to updating this however though!

Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,8 @@ jobs:
steps:
- name: Checkout action
uses: actions/checkout@v4
with:
persist-credentials: false
- name: Setup the Node runtime for this project
uses: actions/setup-node@v4
with:
Expand Down
3 changes: 3 additions & 0 deletions .github/workflows/publish.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,10 +8,13 @@ jobs:
build:
name: Build and tag a new version
runs-on: ubuntu-latest
permissions:
contents: write
steps:
- name: Checkout the current code
uses: actions/checkout@v4
with:
persist-credentials: false
ref: ${{ github.event.release.tag_name }}

- name: Configure the runtime node
Expand Down
5 changes: 4 additions & 1 deletion .github/workflows/test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,10 +11,13 @@ jobs:
name: Run tests
runs-on: ubuntu-latest
environment: staging
permissions:
checks: write
steps:
- name: "build: checkout the latest changes"
uses: actions/checkout@v4
with:
persist-credentials: false
ref: ${{ github.event.pull_request.head.sha }}

- name: "build: setup the node runtime"
Expand Down Expand Up @@ -226,7 +229,7 @@ jobs:
- name: "chore(health): check up on recent changes to the health score"
uses: slackapi/slack-health-score@v0.1.1
with:
codecov_token: ${{ secrets.CODECOV_TOKEN }}
codecov_token: ${{ secrets.CODECOV_API_TOKEN }}
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This was changed to be an API token and has been added as a secret- https://github.com/slackapi/slack-health-score/?tab=readme-ov-file#api-tokens

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Oh and this was changed because the standard upload token was being used: https://github.com/slackapi/slack-github-action/actions/runs/12173268802/job/33953505599#step:31:257

I don't think the testing workflow in this PR will show an update due to pull_request_target, but I'm optimistic with this change working here 🙏

github_token: ${{ secrets.GITHUB_TOKEN }}
extension: js
include: src
Loading