mirror of
https://github.com/penpot/penpot.git
synced 2026-10-29 14:00:37 +00:00
7f95439bc2
Add an explicit permissions block to every workflow that relied on the
repository default. Entry points that only call reusable workflows get
permissions: {} and grant each call what the called workflow needs:
contents: read for the bundle and docker builds, contents: write for the
release, nothing for the admin-console dispatch (it uses its own token).
Workflows that check out code get contents: read; the commit checker
also gets pull-requests: read to list the PR commits.
Signed-off-by: David Barragán Merino <david.barragan@kaleidos.net>
46 lines
1.3 KiB
YAML
46 lines
1.3 KiB
YAML
name: _TMP TOKENS
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
# schedule:
|
|
# - cron: '46 5-20 * * 1-5'
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}
|
|
cancel-in-progress: true
|
|
|
|
permissions: {}
|
|
|
|
jobs:
|
|
build-bundle:
|
|
permissions:
|
|
contents: read
|
|
uses: ./.github/workflows/build-bundle.yml
|
|
secrets:
|
|
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
|
|
AWS_REGION: ${{ secrets.AWS_REGION }}
|
|
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
|
|
MATTERMOST_WEBHOOK: ${{ secrets.MATTERMOST_WEBHOOK }}
|
|
S3_BUCKET: ${{ secrets.S3_BUCKET }}
|
|
with:
|
|
gh_ref: "hiru-tokens-in-libs"
|
|
|
|
build-docker:
|
|
needs: build-bundle
|
|
permissions:
|
|
contents: read
|
|
uses: ./.github/workflows/build-docker.yml
|
|
secrets:
|
|
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
|
|
AWS_REGION: ${{ secrets.AWS_REGION }}
|
|
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
|
|
DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
|
|
DOCKER_REGISTRY: ${{ secrets.DOCKER_REGISTRY }}
|
|
DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
|
|
MATTERMOST_WEBHOOK: ${{ secrets.MATTERMOST_WEBHOOK }}
|
|
PUB_DOCKER_PASSWORD: ${{ secrets.PUB_DOCKER_PASSWORD }}
|
|
PUB_DOCKER_USERNAME: ${{ secrets.PUB_DOCKER_USERNAME }}
|
|
S3_BUCKET: ${{ secrets.S3_BUCKET }}
|
|
with:
|
|
gh_ref: "hiru-tokens-in-libs"
|