mirror of
https://github.com/submariner-io/submariner-charts.git
synced 2026-09-20 22:40:34 +00:00
Daniel FarrellandStephen Kitt
e16a2c36df
Set the GitHub Actions token permission to null in most workflows. This results in: GITHUB_TOKEN Permissions Metadata: read The default permissions, used without the null override, are either GITHUB_TOKEN Permissions Actions: write Checks: write Contents: write Deployments: write Discussions: write Issues: write Metadata: read Packages: write Pages: write PullRequests: write RepositoryProjects: write SecurityEvents: write Statuses: write or GITHUB_TOKEN Permissions Actions: read Checks: read Contents: read Deployments: read Discussions: read Issues: read Metadata: read Packages: read Pages: read PullRequests: read RepositoryProjects: read SecurityEvents: read Statuses: read Jobs triggered by PRs get read permissions, other jobs get write. One job requires non-null permissions to function. The dependent issues GHA needs PR/issues write permissions to add/remove `dependent` labels. It needs status write permission to block/unblock PRs when dependencies are missing/met. Fails with HttpError otherwise. Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
39 lines
1.0 KiB
YAML
39 lines
1.0 KiB
YAML
---
|
|
name: End to End Full
|
|
|
|
on:
|
|
pull_request:
|
|
types: [labeled, opened, synchronize, reopened]
|
|
|
|
permissions: {}
|
|
|
|
jobs:
|
|
e2e:
|
|
name: E2E
|
|
if: contains(github.event.pull_request.labels.*.name, 'ready-to-test')
|
|
timeout-minutes: 45
|
|
runs-on: ubuntu-latest
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
cable_driver: ['libreswan', 'wireguard', 'vxlan']
|
|
globalnet: ['', 'globalnet']
|
|
k8s_version: ['1.24']
|
|
lighthouse: ['', 'lighthouse']
|
|
include:
|
|
- k8s_version: '1.22'
|
|
- k8s_version: '1.23'
|
|
steps:
|
|
- name: Check out the repository
|
|
uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
|
|
|
|
- name: Run E2E deployment and tests
|
|
uses: submariner-io/shipyard/gh-actions/e2e@devel
|
|
with:
|
|
k8s_version: ${{ matrix.k8s_version }}
|
|
using: ${{ matrix.cable_driver }} ${{ matrix.globalnet }} ${{ matrix.lighthouse }}
|
|
|
|
- name: Post mortem
|
|
if: failure()
|
|
uses: submariner-io/shipyard/gh-actions/post-mortem@devel
|