GeezerVison is showing github.com — build: add GitHub token permissions for workflows · nodejs/node@364deea
File tree
Expand file treeCollapse file tree
Open diff view settings
Expand file treeCollapse file tree
Open diff view settings
Collapse file
Copy file name to clipboardExpand all lines: .github/workflows/authors.yml +3Lines changed: 3 additions & 0 deletions | Original file line number | Diff line number | Diff line change |
|---|
|
6 | 6 |
|
7 | 7 | workflow_dispatch: |
8 | 8 |
|
| 9 | +permissions: |
| 10 | + contents: read |
| 11 | + |
9 | 12 | jobs: |
10 | 13 | authors_update: |
11 | 14 | if: github.repository == 'nodejs/node' |
|
Collapse file
Copy file name to clipboardExpand all lines: .github/workflows/auto-start-ci.yml +8Lines changed: 8 additions & 0 deletions | Original file line number | Diff line number | Diff line change |
|---|
@@ -13,8 +13,13 @@ concurrency: ${{ github.workflow }} |
13 | 13 | env: |
14 | 14 | NODE_VERSION: lts/* |
15 | 15 |
|
| 16 | +permissions: |
| 17 | + contents: read |
| 18 | + |
16 | 19 | jobs: |
17 | 20 | get-prs-for-ci: |
| 21 | + permissions: |
| 22 | + pull-requests: read |
18 | 23 | if: github.repository == 'nodejs/node' |
19 | 24 | runs-on: ubuntu-latest |
20 | 25 | outputs: |
|
32 | 37 | env: |
33 | 38 | GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} |
34 | 39 | start-ci: |
| 40 | + permissions: |
| 41 | + contents: read |
| 42 | + pull-requests: write |
35 | 43 | needs: get-prs-for-ci |
36 | 44 | if: needs.get-prs-for-ci.outputs.numbers != '' |
37 | 45 | runs-on: ubuntu-latest |
|
Collapse file
Copy file name to clipboardExpand all lines: .github/workflows/build-tarball.yml +3Lines changed: 3 additions & 0 deletions | Original file line number | Diff line number | Diff line change |
|---|
|
31 | 31 | PYTHON_VERSION: '3.10' |
32 | 32 | FLAKY_TESTS: dontcare |
33 | 33 |
|
| 34 | +permissions: |
| 35 | + contents: read |
| 36 | + |
34 | 37 | jobs: |
35 | 38 | build-tarball: |
36 | 39 | if: github.event.pull_request.draft == false |
|
Collapse file
Copy file name to clipboardExpand all lines: .github/workflows/build-windows.yml +3Lines changed: 3 additions & 0 deletions | Original file line number | Diff line number | Diff line change |
|---|
|
26 | 26 | PYTHON_VERSION: '3.10' |
27 | 27 | FLAKY_TESTS: dontcare |
28 | 28 |
|
| 29 | +permissions: |
| 30 | + contents: read |
| 31 | + |
29 | 32 | jobs: |
30 | 33 | build-windows: |
31 | 34 | if: github.event.pull_request.draft == false |
|
Collapse file
Copy file name to clipboardExpand all lines: .github/workflows/close-stale-feature-requests.yml +6Lines changed: 6 additions & 0 deletions | Original file line number | Diff line number | Diff line change |
|---|
|
28 | 28 | [feature request management document](https://github.com/nodejs/node/blob/HEAD/doc/contributing/feature-request-management.md). |
29 | 29 | # yamllint enable |
30 | 30 |
|
| 31 | +permissions: |
| 32 | + contents: read |
| 33 | + |
31 | 34 | jobs: |
32 | 35 | stale: |
| 36 | + permissions: |
| 37 | + issues: write # for actions/stale to close stale issues |
| 38 | + pull-requests: write # for actions/stale to close stale PRs |
33 | 39 | if: github.repository == 'nodejs/node' |
34 | 40 | runs-on: ubuntu-latest |
35 | 41 | steps: |
|
Collapse file
Copy file name to clipboardExpand all lines: .github/workflows/close-stalled.yml +6Lines changed: 6 additions & 0 deletions | Original file line number | Diff line number | Diff line change |
|---|
|
9 | 9 | is still relevant, or to ping the collaborator who labelled it stalled if |
10 | 10 | you have any questions. |
11 | 11 |
|
| 12 | +permissions: |
| 13 | + contents: read |
| 14 | + |
12 | 15 | jobs: |
13 | 16 | stale: |
| 17 | + permissions: |
| 18 | + issues: write # for actions/stale to close stale issues |
| 19 | + pull-requests: write # for actions/stale to close stale PRs |
14 | 20 | if: github.repository == 'nodejs/node' |
15 | 21 | runs-on: ubuntu-latest |
16 | 22 | steps: |
|
Collapse file
Copy file name to clipboardExpand all lines: .github/workflows/comment-labeled.yml +8Lines changed: 8 additions & 0 deletions | Original file line number | Diff line number | Diff line change |
|---|
|
11 | 11 | If it should remain open, please leave a comment explaining why it should remain open. |
12 | 12 | FAST_TRACK_MESSAGE: Fast-track has been requested by @${{ github.actor }}. Please 👍 to approve. |
13 | 13 |
|
| 14 | +permissions: |
| 15 | + contents: read |
| 16 | + |
14 | 17 | jobs: |
15 | 18 | stale-comment: |
| 19 | + permissions: |
| 20 | + issues: write |
| 21 | + pull-requests: write |
16 | 22 | if: github.repository == 'nodejs/node' && github.event.label.name == 'stalled' |
17 | 23 | runs-on: ubuntu-latest |
18 | 24 | steps: |
|
23 | 29 | run: gh issue comment "$NUMBER" --repo ${{ github.repository }} --body "$STALE_MESSAGE" |
24 | 30 |
|
25 | 31 | fast-track: |
| 32 | + permissions: |
| 33 | + pull-requests: write |
26 | 34 | if: github.repository == 'nodejs/node' && github.event_name == 'pull_request_target' && github.event.label.name == 'fast-track' |
27 | 35 | runs-on: ubuntu-latest |
28 | 36 | steps: |
|
Collapse file
Copy file name to clipboardExpand all lines: .github/workflows/commit-lint.yml +3Lines changed: 3 additions & 0 deletions | Original file line number | Diff line number | Diff line change |
|---|
@@ -5,6 +5,9 @@ on: [pull_request] |
5 | 5 | env: |
6 | 6 | NODE_VERSION: lts/* |
7 | 7 |
|
| 8 | +permissions: |
| 9 | + contents: read |
| 10 | + |
8 | 11 | jobs: |
9 | 12 | lint-commit-message: |
10 | 13 | runs-on: ubuntu-latest |
|
Collapse file
Copy file name to clipboardExpand all lines: .github/workflows/commit-queue.yml +5Lines changed: 5 additions & 0 deletions | Original file line number | Diff line number | Diff line change |
|---|
@@ -18,8 +18,13 @@ concurrency: ${{ github.workflow }} |
18 | 18 | env: |
19 | 19 | NODE_VERSION: lts/* |
20 | 20 |
|
| 21 | +permissions: |
| 22 | + contents: read |
| 23 | + |
21 | 24 | jobs: |
22 | 25 | get_mergeable_prs: |
| 26 | + permissions: |
| 27 | + pull-requests: read |
23 | 28 | if: github.repository == 'nodejs/node' |
24 | 29 | runs-on: ubuntu-latest |
25 | 30 | outputs: |
|
Collapse file
Copy file name to clipboardExpand all lines: .github/workflows/coverage-linux.yml +3Lines changed: 3 additions & 0 deletions | Original file line number | Diff line number | Diff line change |
|---|
|
29 | 29 | PYTHON_VERSION: '3.10' |
30 | 30 | FLAKY_TESTS: dontcare |
31 | 31 |
|
| 32 | +permissions: |
| 33 | + contents: read |
| 34 | + |
32 | 35 | jobs: |
33 | 36 | coverage-linux: |
34 | 37 | if: github.event.pull_request.draft == false |
|