mirror of
https://github.com/penpot/penpot.git
synced 2026-10-29 14:00:37 +00:00
7f95439bc2
Add an explicit permissions block to every workflow that relied on the
repository default. Entry points that only call reusable workflows get
permissions: {} and grant each call what the called workflow needs:
contents: read for the bundle and docker builds, contents: write for the
release, nothing for the admin-console dispatch (it uses its own token).
Workflows that check out code get contents: read; the commit checker
also gets pull-requests: read to list the PR commits.
Signed-off-by: David Barragán Merino <david.barragan@kaleidos.net>
70 lines
2.2 KiB
YAML
70 lines
2.2 KiB
YAML
name: _ADHOC
|
|
|
|
run-name: >-
|
|
_ADHOC (${{ inputs.gh_ref }}${{ inputs.nitrate_ref != '' && format(' / nitrate:{0}', inputs.nitrate_ref) || '' }})
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
gh_ref:
|
|
description: 'Branch/ref to build in penpot/penpot'
|
|
type: string
|
|
required: true
|
|
nitrate_ref:
|
|
description: 'Branch/ref to build admin-console in penpot/penpot-nitrate (defaults to gh_ref)'
|
|
type: string
|
|
required: false
|
|
force:
|
|
description: 'Rebuild and overwrite even if already built/promoted'
|
|
type: boolean
|
|
required: false
|
|
default: false
|
|
|
|
permissions: {}
|
|
|
|
jobs:
|
|
build-bundle:
|
|
permissions:
|
|
contents: read
|
|
uses: ./.github/workflows/build-bundle.yml
|
|
secrets:
|
|
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
|
|
AWS_REGION: ${{ secrets.AWS_REGION }}
|
|
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
|
|
MATTERMOST_WEBHOOK: ${{ secrets.MATTERMOST_WEBHOOK }}
|
|
S3_BUCKET: ${{ secrets.S3_BUCKET }}
|
|
with:
|
|
gh_ref: ${{ inputs.gh_ref }}
|
|
force: ${{ inputs.force }}
|
|
|
|
build-docker:
|
|
needs: build-bundle
|
|
permissions:
|
|
contents: read
|
|
uses: ./.github/workflows/build-docker.yml
|
|
secrets:
|
|
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
|
|
AWS_REGION: ${{ secrets.AWS_REGION }}
|
|
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
|
|
DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
|
|
DOCKER_REGISTRY: ${{ secrets.DOCKER_REGISTRY }}
|
|
DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
|
|
MATTERMOST_WEBHOOK: ${{ secrets.MATTERMOST_WEBHOOK }}
|
|
PUB_DOCKER_PASSWORD: ${{ secrets.PUB_DOCKER_PASSWORD }}
|
|
PUB_DOCKER_USERNAME: ${{ secrets.PUB_DOCKER_USERNAME }}
|
|
S3_BUCKET: ${{ secrets.S3_BUCKET }}
|
|
with:
|
|
gh_ref: ${{ inputs.gh_ref }}
|
|
# Pin build-docker to the commit build-bundle actually bundled.
|
|
sha: ${{ needs.build-bundle.outputs.sha }}
|
|
force: ${{ inputs.force }}
|
|
|
|
build-docker-admin-console:
|
|
permissions: {}
|
|
uses: ./.github/workflows/build-docker-admin-console.yml
|
|
secrets:
|
|
ORG_WORKFLOW_TOKEN: ${{ secrets.ORG_WORKFLOW_TOKEN }}
|
|
with:
|
|
gh_ref: ${{ inputs.nitrate_ref || inputs.gh_ref }}
|
|
force: ${{ inputs.force }}
|