Minimize GHA permissions

mirror of https://github.com/submariner-io/submariner-charts.git synced 2026-09-20 20:20:35 +00:00

Set the GitHub Actions token permission to null in most workflows.

This results in:

GITHUB_TOKEN Permissions
  Metadata: read

The default permissions, used without the null override, are either

GITHUB_TOKEN Permissions
  Actions: write
  Checks: write
  Contents: write
  Deployments: write
  Discussions: write
  Issues: write
  Metadata: read
  Packages: write
  Pages: write
  PullRequests: write
  RepositoryProjects: write
  SecurityEvents: write
  Statuses: write

or

GITHUB_TOKEN Permissions
  Actions: read
  Checks: read
  Contents: read
  Deployments: read
  Discussions: read
  Issues: read
  Metadata: read
  Packages: read
  Pages: read
  PullRequests: read
  RepositoryProjects: read
  SecurityEvents: read
  Statuses: read

Jobs triggered by PRs get read permissions, other jobs get write.

One job requires non-null permissions to function.

The dependent issues GHA needs PR/issues write permissions to add/remove
`dependent` labels. It needs status write permission to block/unblock
PRs when dependencies are missing/met. Fails with HttpError otherwise.

Signed-off-by: Daniel Farrell <dfarrell@redhat.com>

This commit is contained in:

Daniel Farrell

2022-08-25 10:47:32 +02:00

committed by

Stephen Kitt

parent 01599cbb65

commit e16a2c36df

8 changed files with 19 additions and 0 deletions

									
										.github/workflows/release.yml
									
		+2
		
												View File
												
				@@ -6,6 +6,8 @@ on:

				    branches:

				      - devel

				permissions: {}

				jobs:

				  release:

				    name: Release