github/penpot
1
0
Fork 0
mirror of https://github.com/penpot/penpot.git synced 2026-10-30 06:20:32 +00:00
Code Issues Packages Projects Releases Wiki Activity
24,215 Commits 273 Branches 351 Tags
Commit Graph

13 Commits

Author SHA1 Message Date
Andrey Antukh
ff4c4a4a34 📎 Backport .github and scripts/ci from develop 2026-10-08 19:24:58 +02:00
David Barragán Merino
2c4da98131 🐛 Request pull-requests permission in auto-label token 
Signed-off-by: David Barragán Merino <david.barragan@kaleidos.net>
 2026-10-05 14:38:06 +02:00
David Barragán Merino
6435261359 🔧 Use client-id instead of app-id in auto-label workflow 
actions/create-github-app-token v3 deprecates the app-id input in
favour of client-id. Switch to the new TRIAGE_APP_CLIENT_ID secret.

Signed-off-by: David Barragán Merino <david.barragan@kaleidos.net>
 2026-10-05 14:38:06 +02:00
dependabot[bot]
a3ba4702d7 ⬆️ Bump the github-actions group across 1 directory with 8 updates 
Bumps the github-actions group with 8 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [actions/create-github-app-token](https://github.com/actions/create-github-app-token) | `1.12.0` | `3.2.0` |
| [actions/github-script](https://github.com/actions/github-script) | `7.1.0` | `9.0.0` |
| [actions/checkout](https://github.com/actions/checkout) | `6.1.0` | `7.0.1` |
| [pnpm/setup](https://github.com/pnpm/setup) | `2.0.2` | `3.0.0` |
| [aws-actions/configure-aws-credentials](https://github.com/aws-actions/configure-aws-credentials) | `4.3.1` | `6.3.0` |
| [actions/cache/restore](https://github.com/actions/cache) | `5.1.0` | `6.1.0` |
| [actions/cache/save](https://github.com/actions/cache) | `5.1.0` | `6.1.0` |
| [actions/download-artifact](https://github.com/actions/download-artifact) | `7.0.0` | `8.0.1` |



Updates `actions/create-github-app-token` from 1.12.0 to 3.2.0
- [Release notes](https://github.com/actions/create-github-app-token/releases)
- [Changelog](https://github.com/actions/create-github-app-token/blob/main/CHANGELOG.md)
- [Commits](d72941d797...bcd2ba4921)

Updates `actions/github-script` from 7.1.0 to 9.0.0
- [Release notes](https://github.com/actions/github-script/releases)
- [Commits](f28e40c7f3...3a2844b7e9)

Updates `actions/checkout` from 6.1.0 to 7.0.1
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](d23441a48e...3d3c42e5aa)

Updates `pnpm/setup` from 2.0.2 to 3.0.0
- [Release notes](https://github.com/pnpm/setup/releases)
- [Commits](84cb39b217...fbda4c85fc)

Updates `aws-actions/configure-aws-credentials` from 4.3.1 to 6.3.0
- [Release notes](https://github.com/aws-actions/configure-aws-credentials/releases)
- [Changelog](https://github.com/aws-actions/configure-aws-credentials/blob/main/CHANGELOG.md)
- [Commits](7474bc4690...e1253824e5)

Updates `actions/cache/restore` from 5.1.0 to 6.1.0
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](caa2961268...55cc834586)

Updates `actions/cache/save` from 5.1.0 to 6.1.0
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](caa2961268...55cc834586)

Updates `actions/download-artifact` from 7.0.0 to 8.0.1
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](37930b1c2a...3e5f45b2cf)

---
updated-dependencies:
- dependency-name: actions/create-github-app-token
  dependency-version: 3.2.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/github-script
  dependency-version: 9.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/checkout
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: pnpm/setup
  dependency-version: 3.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: aws-actions/configure-aws-credentials
  dependency-version: 6.3.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/cache/restore
  dependency-version: 6.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/cache/save
  dependency-version: 6.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/download-artifact
  dependency-version: 8.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-10-05 14:38:06 +02:00
David Barragán Merino
7e73a42123 👷 Label Dependabot PRs and skip them in auto-label 
Dependabot PRs get the dependencies, team infra and no issue required
labels, and auto-label no longer adds them to the triage board.

AI-assisted-by: Claude
Signed-off-by: David Barragán Merino <david.barragan@kaleidos.net>
 2026-10-02 12:27:34 +02:00
David Barragán Merino
46d64da931 👷 Scope the triage GitHub App token 
Request a token for this repository only, instead of every repository
in the installation, and only with the permissions the job uses: issues
(labels) and organization projects (the board). Also document why the
workflow needs pull_request_target and why it is safe.

Signed-off-by: David Barragán Merino <david.barragan@kaleidos.net>
 2026-10-02 09:50:58 +02:00
David Barragán Merino
7f95439bc2 👷 Declare least-privilege workflow permissions 
Add an explicit permissions block to every workflow that relied on the
repository default. Entry points that only call reusable workflows get
permissions: {} and grant each call what the called workflow needs:
contents: read for the bundle and docker builds, contents: write for the
release, nothing for the admin-console dispatch (it uses its own token).
Workflows that check out code get contents: read; the commit checker
also gets pull-requests: read to list the PR commits.

Signed-off-by: David Barragán Merino <david.barragan@kaleidos.net>
 2026-10-02 09:50:58 +02:00
David Barragán Merino
d1aa07087d 👷 Pin GitHub Actions to commit SHAs 
Signed-off-by: David Barragán Merino <david.barragan@kaleidos.net>
 2026-09-30 15:29:28 +02:00
David Barragán Merino
17c344b8f5 🐛 Fix auto-label action failing on PRs from forked repos 2026-07-16 10:15:22 +02:00
David Barragán Merino
14fb211733 🐛 Set org as owner for auto-label workflow 2026-06-25 12:41:18 +02:00
David Barragán Merino
ce1191d86f 🐛 fix missing app-id in auto-label workflow 2026-06-25 11:53:07 +02:00
David Barragán Merino
f996ef372d 🔧 Migrate auto-label workflow from PAT to GitHub App toke 2026-06-25 11:26:15 +02:00
Andrey Antukh
1b3a3b4cdb 📎 Add auto-label and auto-project github workflow 2026-06-23 11:27:38 +02:00