* [PR PATCH] .github/workflows/: set token permissions
@ 2022-07-03 0:27 classabbyamp
2022-07-03 0:46 ` [PR PATCH] [Merged]: " the-maldridge
0 siblings, 1 reply; 2+ messages in thread
From: classabbyamp @ 2022-07-03 0:27 UTC (permalink / raw)
To: ml
[-- Attachment #1: Type: text/plain, Size: 512 bytes --]
There is a new pull request by classabbyamp against master on the void-packages repository
https://github.com/classabbyamp/void-packages fix/ci-perms
https://github.com/void-linux/void-packages/pull/37810
.github/workflows/: set token permissions
<!-- Uncomment relevant sections and delete options which are not applicable -->
#### Testing the changes
- I tested the changes in this PR: **YES**
closes #37612
A patch file from https://github.com/void-linux/void-packages/pull/37810.patch is attached
[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #2: github-pr-fix/ci-perms-37810.patch --]
[-- Type: text/x-diff, Size: 1093 bytes --]
From 32b2d92b4476dc9c640597980d65ee4a3fca3a6e Mon Sep 17 00:00:00 2001
From: classabbyamp <void@placeviolette.net>
Date: Sat, 2 Jul 2022 20:23:54 -0400
Subject: [PATCH] .github/workflows/: set token permissions
---
.github/workflows/cycles.yml | 2 ++
.github/workflows/stale.yml | 3 +++
2 files changed, 5 insertions(+)
diff --git a/.github/workflows/cycles.yml b/.github/workflows/cycles.yml
index 0bd148e77f0a..018c0909bdb1 100644
--- a/.github/workflows/cycles.yml
+++ b/.github/workflows/cycles.yml
@@ -7,6 +7,8 @@ on:
jobs:
cycles:
runs-on: ubuntu-latest
+ permissions:
+ issues: write
container:
image: 'ghcr.io/void-linux/xbps-src-masterdir:20220527RC01-x86_64-musl'
steps:
diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
index 160897fedef1..c55c7966a678 100644
--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -9,6 +9,9 @@ on:
jobs:
stale:
runs-on: ubuntu-latest
+ permissions:
+ issues: write
+ pull-requests: write
steps:
- uses: actions/stale@v4
with:
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: [PR PATCH] [Merged]: .github/workflows/: set token permissions
2022-07-03 0:27 [PR PATCH] .github/workflows/: set token permissions classabbyamp
@ 2022-07-03 0:46 ` the-maldridge
0 siblings, 0 replies; 2+ messages in thread
From: the-maldridge @ 2022-07-03 0:46 UTC (permalink / raw)
To: ml
[-- Attachment #1: Type: text/plain, Size: 982 bytes --]
There's a merged pull request on the void-packages repository
.github/workflows/: set token permissions
https://github.com/void-linux/void-packages/pull/37810
Description:
<!-- Uncomment relevant sections and delete options which are not applicable -->
#### Testing the changes
- I tested the changes in this PR: **YES**
closes #37612
requires changing the default workflow permissions in the [repository settings](https://github.com/void-linux/void-packages/settings/actions) to:
The default permissions are read-only, which works fine for the build/PR CI workflow. Cycles needed write access to issues to create them if a cycle is detected. Stale needs write access to issues and pull requests, as is [documented upstream](https://github.com/actions/stale#recommended-permissions). This is safe because both those workflows should only run on master.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2022-07-03 0:46 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-07-03 0:27 [PR PATCH] .github/workflows/: set token permissions classabbyamp
2022-07-03 0:46 ` [PR PATCH] [Merged]: " the-maldridge
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).