Minimize GHA permissions

mirror of https://github.com/submariner-io/submariner-charts.git synced 2026-09-20 22:40:34 +00:00

Set the GitHub Actions token permission to null in most workflows.

This results in:

GITHUB_TOKEN Permissions
  Metadata: read

The default permissions, used without the null override, are either

GITHUB_TOKEN Permissions
  Actions: write
  Checks: write
  Contents: write
  Deployments: write
  Discussions: write
  Issues: write
  Metadata: read
  Packages: write
  Pages: write
  PullRequests: write
  RepositoryProjects: write
  SecurityEvents: write
  Statuses: write

or

GITHUB_TOKEN Permissions
  Actions: read
  Checks: read
  Contents: read
  Deployments: read
  Discussions: read
  Issues: read
  Metadata: read
  Packages: read
  Pages: read
  PullRequests: read
  RepositoryProjects: read
  SecurityEvents: read
  Statuses: read

Jobs triggered by PRs get read permissions, other jobs get write.

One job requires non-null permissions to function.

The dependent issues GHA needs PR/issues write permissions to add/remove
`dependent` labels. It needs status write permission to block/unblock
PRs when dependencies are missing/met. Fails with HttpError otherwise.

Signed-off-by: Daniel Farrell <dfarrell@redhat.com>

This commit is contained in:

Daniel Farrell

2022-08-25 10:47:32 +02:00

committed by

Stephen Kitt

parent 01599cbb65

commit e16a2c36df

8 changed files with 19 additions and 0 deletions

									
										.github/workflows/e2e-full.yml
									
		+2
		
												View File
												
				@@ -5,6 +5,8 @@ on:

				  pull_request:

				    types: [labeled, opened, synchronize, reopened]

				permissions: {}

				jobs:

				  e2e:

				    name: E2E