Skip to content

fix: adds permissions to all workflows #505

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Mar 5, 2025
Merged

fix: adds permissions to all workflows #505

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
1251ca6
fix: adds permissions to ci workflow
reggi Mar 5, 2025
fab144f
chore: adds permissions to all wfs
reggi Mar 5, 2025
97718c8
updates snaps
reggi Mar 5, 2025
File filter

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions .github/workflows/audit.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,9 @@ on:
# "At 08:00 UTC (01:00 PT) on Monday" https://crontab.guru/#0_8_*_*_1
- cron: "0 8 * * 1"

permissions:
contents: read

jobs:
audit:
name: Audit Dependencies
Expand Down
4 changes: 4 additions & 0 deletions .github/workflows/ci-release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,10 @@ on:
required: true
type: string

permissions:
contents: read
checks: write

jobs:
lint-all:
name: Lint All
Expand Down
3 changes: 3 additions & 0 deletions .github/workflows/ci-test-workspace.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,9 @@ on:
# "At 09:00 UTC (02:00 PT) on Monday" https://crontab.guru/#0_9_*_*_1
- cron: "0 9 * * 1"

permissions:
contents: read

jobs:
lint:
name: Lint
Expand Down
3 changes: 3 additions & 0 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,9 @@ on:
# "At 09:00 UTC (02:00 PT) on Monday" https://crontab.guru/#0_9_*_*_1
- cron: "0 9 * * 1"

permissions:
contents: read

jobs:
lint:
name: Lint
Expand Down
3 changes: 3 additions & 0 deletions .github/workflows/codeql-analysis.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,9 @@ on:
# "At 10:00 UTC (03:00 PT) on Monday" https://crontab.guru/#0_10_*_*_1
- cron: "0 10 * * 1"

permissions:
contents: read

jobs:
analyze:
name: Analyze
Expand Down
3 changes: 3 additions & 0 deletions .github/workflows/pull-request.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,9 @@ on:
- edited
- synchronize

permissions:
contents: read

jobs:
commitlint:
name: Lint Commits
Expand Down
3 changes: 3 additions & 0 deletions .github/workflows/release-integration.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,9 @@ on:
PUBLISH_TOKEN:
required: true

permissions:
contents: read

jobs:
publish:
name: Publish
Expand Down
3 changes: 3 additions & 0 deletions lib/content/audit-yml.hbs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,9 @@ on:
# "At 08:00 UTC (01:00 PT) on Monday" https://crontab.guru/#0_8_*_*_1
- cron: "0 8 * * 1"

permissions:
contents: read

jobs:
audit:
{{> jobYml jobName="Audit Dependencies" jobDepFlags="--package-lock" }}
Expand Down
4 changes: 4 additions & 0 deletions lib/content/ci-release-yml.hbs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,10 @@ on:
required: true
type: string

permissions:
contents: read
checks: write

jobs:
lint-all:
{{> jobYml
Expand Down
3 changes: 3 additions & 0 deletions lib/content/ci-yml.hbs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,9 @@ name: CI {{~#if isWorkspace}} - {{ pkgName }}{{/if}}
on:
{{> onCiYml }}

permissions:
contents: read

jobs:
lint:
{{> jobYml jobName="Lint" }}
Expand Down
3 changes: 3 additions & 0 deletions lib/content/codeql-analysis-yml.hbs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,9 @@ on:
# "At 10:00 UTC (03:00 PT) on Monday" https://crontab.guru/#0_10_*_*_1
- cron: "0 10 * * 1"

permissions:
contents: read

jobs:
analyze:
name: Analyze
Expand Down
3 changes: 3 additions & 0 deletions lib/content/pull-request-yml.hbs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,9 @@ on:
- edited
- synchronize

permissions:
contents: read

jobs:
commitlint:
{{> jobYml jobName="Lint Commits" jobCheckout=(obj fetch-depth=0) }}
Expand Down
3 changes: 3 additions & 0 deletions lib/content/release-integration-yml.hbs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,9 @@ on:
required: true
{{/if}}

permissions:
contents: read

jobs:
publish:
{{> jobReleaseIntegrationYml }}
60 changes: 60 additions & 0 deletions tap-snapshots/test/apply/source-snapshots.js.test.cjs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -356,6 +356,9 @@ on:
# "At 08:00 UTC (01:00 PT) on Monday" https://crontab.guru/#0_8_*_*_1
- cron: "0 8 * * 1"

permissions:
contents: read

jobs:
audit:
name: Audit Dependencies
Expand Down Expand Up @@ -410,6 +413,10 @@ on:
required: true
type: string

permissions:
contents: read
checks: write

jobs:
lint-all:
name: Lint All
Expand Down Expand Up @@ -546,6 +553,9 @@ on:
# "At 09:00 UTC (02:00 PT) on Monday" https://crontab.guru/#0_9_*_*_1
- cron: "0 9 * * 1"

permissions:
contents: read

jobs:
lint:
name: Lint
Expand Down Expand Up @@ -651,6 +661,9 @@ on:
# "At 10:00 UTC (03:00 PT) on Monday" https://crontab.guru/#0_10_*_*_1
- cron: "0 10 * * 1"

permissions:
contents: read

jobs:
analyze:
name: Analyze
Expand Down Expand Up @@ -813,6 +826,9 @@ on:
- edited
- synchronize

permissions:
contents: read

jobs:
commitlint:
name: Lint Commits
Expand Down Expand Up @@ -872,6 +888,9 @@ on:
type: string
description: 'A json array of releases. Required fields: publish: tagName, publishTag. publish check: pkgName, version'

permissions:
contents: read

jobs:
publish:
name: Check Publish
Expand Down Expand Up @@ -1797,6 +1816,9 @@ on:
# "At 08:00 UTC (01:00 PT) on Monday" https://crontab.guru/#0_8_*_*_1
- cron: "0 8 * * 1"

permissions:
contents: read

jobs:
audit:
name: Audit Dependencies
Expand Down Expand Up @@ -1851,6 +1873,9 @@ on:
# "At 09:00 UTC (02:00 PT) on Monday" https://crontab.guru/#0_9_*_*_1
- cron: "0 9 * * 1"

permissions:
contents: read

jobs:
lint:
name: Lint
Expand Down Expand Up @@ -1957,6 +1982,9 @@ on:
# "At 09:00 UTC (02:00 PT) on Monday" https://crontab.guru/#0_9_*_*_1
- cron: "0 9 * * 1"

permissions:
contents: read

jobs:
lint:
name: Lint
Expand Down Expand Up @@ -2063,6 +2091,10 @@ on:
required: true
type: string

permissions:
contents: read
checks: write

jobs:
lint-all:
name: Lint All
Expand Down Expand Up @@ -2205,6 +2237,9 @@ on:
# "At 09:00 UTC (02:00 PT) on Monday" https://crontab.guru/#0_9_*_*_1
- cron: "0 9 * * 1"

permissions:
contents: read

jobs:
lint:
name: Lint
Expand Down Expand Up @@ -2310,6 +2345,9 @@ on:
# "At 10:00 UTC (03:00 PT) on Monday" https://crontab.guru/#0_10_*_*_1
- cron: "0 10 * * 1"

permissions:
contents: read

jobs:
analyze:
name: Analyze
Expand Down Expand Up @@ -2472,6 +2510,9 @@ on:
- edited
- synchronize

permissions:
contents: read

jobs:
commitlint:
name: Lint Commits
Expand Down Expand Up @@ -2531,6 +2572,9 @@ on:
type: string
description: 'A json array of releases. Required fields: publish: tagName, publishTag. publish check: pkgName, version'

permissions:
contents: read

jobs:
publish:
name: Check Publish
Expand Down Expand Up @@ -3526,6 +3570,9 @@ on:
# "At 09:00 UTC (02:00 PT) on Monday" https://crontab.guru/#0_9_*_*_1
- cron: "0 9 * * 1"

permissions:
contents: read

jobs:
lint:
name: Lint
Expand Down Expand Up @@ -3632,6 +3679,9 @@ on:
# "At 09:00 UTC (02:00 PT) on Monday" https://crontab.guru/#0_9_*_*_1
- cron: "0 9 * * 1"

permissions:
contents: read

jobs:
lint:
name: Lint
Expand Down Expand Up @@ -3738,6 +3788,10 @@ on:
required: true
type: string

permissions:
contents: read
checks: write

jobs:
lint-all:
name: Lint All
Expand Down Expand Up @@ -3996,6 +4050,9 @@ on:
- edited
- synchronize

permissions:
contents: read

jobs:
commitlint:
name: Lint Commits
Expand Down Expand Up @@ -4055,6 +4112,9 @@ on:
type: string
description: 'A json array of releases. Required fields: publish: tagName, publishTag. publish check: pkgName, version'

permissions:
contents: read

jobs:
publish:
name: Check Publish
Expand Down
13 changes: 8 additions & 5 deletions tap-snapshots/test/check/diff-snapshots.js.test.cjs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -99,23 +99,23 @@ The repo file audit.yml needs to be updated:
[@npmcli/template-oss ERROR] There was an erroring getting the target file
[@npmcli/template-oss ERROR] Error: {{ROOT}}/.tap/fixtures/test-check-diff-snapshots.js-update-and-remove-errors/.github/workflows/audit.yml

YAMLParseError: Implicit keys need to be on a single line at line 42, column 1:
YAMLParseError: Implicit keys need to be on a single line at line 45, column 1:

run: npm audit --audit-level=none
>>>>I HOPE THIS IS NOT VALID YAML<<<<<<<<<<<
^

YAMLParseError: Block scalar header includes extra characters: >>>>I at line 42, column 2:
YAMLParseError: Block scalar header includes extra characters: >>>>I at line 45, column 2:

>>>>I HOPE THIS IS NOT VALID YAML<<<<<<<<<<<
^

YAMLParseError: Not a YAML token: HOPE THIS IS NOT VALID YAML<<<<<<<<<<< at line 42, column 7:
YAMLParseError: Not a YAML token: HOPE THIS IS NOT VALID YAML<<<<<<<<<<< at line 45, column 7:

>>>>I HOPE THIS IS NOT VALID YAML<<<<<<<<<<<
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

YAMLParseError: Implicit map keys need to be followed by map values at line 42, column 1:
YAMLParseError: Implicit map keys need to be followed by map values at line 45, column 1:

run: npm audit --audit-level=none
>>>>I HOPE THIS IS NOT VALID YAML<<<<<<<<<<<
Expand All @@ -134,6 +134,9 @@ The repo file audit.yml needs to be updated:
# "At 08:00 UTC (01:00 PT) on Monday" https://crontab.guru/#0_8_*_*_1
- cron: "0 8 * * 1"

permissions:
contents: read

jobs:
audit:
name: Audit Dependencies
Expand Down Expand Up @@ -175,7 +178,7 @@ The repo file ci.yml needs to be updated:

.github/workflows/ci.yml
========================================
@@ -97,4 +97,24 @@
@@ -100,4 +100,24 @@
shell: \${{ matrix.platform.shell }}
steps:
- name: Checkout
Expand Down
Loading