Skip to content

Commit e2e880b

Browse files
jsorefjsoref
committed
Remove excess permissions from pages workflows
Signed-off-by: Josh Soref <[email protected]>
1 parent 1394e47 commit e2e880b

9 files changed

Lines changed: 79 additions & 54 deletions

File tree

‎pages/astro.yml‎

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -12,12 +12,6 @@ on:
1212
# Allows you to run this workflow manually from the Actions tab
1313
workflow_dispatch:
1414

15-
# Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages
16-
permissions:
17-
contents: read
18-
pages: write
19-
id-token: write
20-
2115
# Allow only one concurrent deployment, skipping runs queued between the run in-progress and latest queued.
2216
# However, do NOT cancel in-progress runs as we want to allow these production deployments to complete.
2317
concurrency:
@@ -31,6 +25,9 @@ env:
3125
jobs:
3226
build:
3327
name: Build
28+
permissions:
29+
contents: read
30+
3431
runs-on: ubuntu-latest
3532
steps:
3633
- name: Checkout
@@ -82,6 +79,12 @@ jobs:
8279
name: github-pages
8380
url: ${{ steps.deployment.outputs.page_url }}
8481
needs: build
82+
83+
# Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages
84+
permissions:
85+
pages: write
86+
id-token: write
87+
8588
runs-on: ubuntu-latest
8689
name: Deploy
8790
steps:

‎pages/gatsby.yml‎

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -12,12 +12,6 @@ on:
1212
# Allows you to run this workflow manually from the Actions tab
1313
workflow_dispatch:
1414

15-
# Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages
16-
permissions:
17-
contents: read
18-
pages: write
19-
id-token: write
20-
2115
# Allow only one concurrent deployment, skipping runs queued between the run in-progress and latest queued.
2216
# However, do NOT cancel in-progress runs as we want to allow these production deployments to complete.
2317
concurrency:
@@ -32,6 +26,9 @@ defaults:
3226
jobs:
3327
# Build job
3428
build:
29+
permissions:
30+
contents: read
31+
3532
runs-on: ubuntu-latest
3633
steps:
3734
- name: Checkout
@@ -89,6 +86,12 @@ jobs:
8986
environment:
9087
name: github-pages
9188
url: ${{ steps.deployment.outputs.page_url }}
89+
90+
# Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages
91+
permissions:
92+
pages: write
93+
id-token: write
94+
9295
runs-on: ubuntu-latest
9396
needs: build
9497
steps:

‎pages/hugo.yml‎

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -9,12 +9,6 @@ on:
99
# Allows you to run this workflow manually from the Actions tab
1010
workflow_dispatch:
1111

12-
# Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages
13-
permissions:
14-
contents: read
15-
pages: write
16-
id-token: write
17-
1812
# Allow only one concurrent deployment, skipping runs queued between the run in-progress and latest queued.
1913
# However, do NOT cancel in-progress runs as we want to allow these production deployments to complete.
2014
concurrency:
@@ -29,6 +23,9 @@ defaults:
2923
jobs:
3024
# Build job
3125
build:
26+
permissions:
27+
contents: read
28+
3229
runs-on: ubuntu-latest
3330
env:
3431
HUGO_VERSION: 0.128.0
@@ -66,6 +63,12 @@ jobs:
6663
environment:
6764
name: github-pages
6865
url: ${{ steps.deployment.outputs.page_url }}
66+
67+
# Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages
68+
permissions:
69+
pages: write
70+
id-token: write
71+
6972
runs-on: ubuntu-latest
7073
needs: build
7174
steps:

‎pages/jekyll-gh-pages.yml‎

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -9,12 +9,6 @@ on:
99
# Allows you to run this workflow manually from the Actions tab
1010
workflow_dispatch:
1111

12-
# Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages
13-
permissions:
14-
contents: read
15-
pages: write
16-
id-token: write
17-
1812
# Allow only one concurrent deployment, skipping runs queued between the run in-progress and latest queued.
1913
# However, do NOT cancel in-progress runs as we want to allow these production deployments to complete.
2014
concurrency:
@@ -24,6 +18,9 @@ concurrency:
2418
jobs:
2519
# Build job
2620
build:
21+
permissions:
22+
contents: read
23+
2724
runs-on: ubuntu-latest
2825
steps:
2926
- name: Checkout
@@ -43,6 +40,12 @@ jobs:
4340
environment:
4441
name: github-pages
4542
url: ${{ steps.deployment.outputs.page_url }}
43+
44+
# Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages
45+
permissions:
46+
pages: write
47+
id-token: write
48+
4649
runs-on: ubuntu-latest
4750
needs: build
4851
steps:

‎pages/jekyll.yml‎

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -14,12 +14,6 @@ on:
1414
# Allows you to run this workflow manually from the Actions tab
1515
workflow_dispatch:
1616

17-
# Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages
18-
permissions:
19-
contents: read
20-
pages: write
21-
id-token: write
22-
2317
# Allow only one concurrent deployment, skipping runs queued between the run in-progress and latest queued.
2418
# However, do NOT cancel in-progress runs as we want to allow these production deployments to complete.
2519
concurrency:
@@ -29,6 +23,9 @@ concurrency:
2923
jobs:
3024
# Build job
3125
build:
26+
permissions:
27+
contents: read
28+
3229
runs-on: ubuntu-latest
3330
steps:
3431
- name: Checkout
@@ -56,6 +53,12 @@ jobs:
5653
environment:
5754
name: github-pages
5855
url: ${{ steps.deployment.outputs.page_url }}
56+
57+
# Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages
58+
permissions:
59+
pages: write
60+
id-token: write
61+
5962
runs-on: ubuntu-latest
6063
needs: build
6164
steps:

‎pages/mdbook.yml‎

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -12,12 +12,6 @@ on:
1212
# Allows you to run this workflow manually from the Actions tab
1313
workflow_dispatch:
1414

15-
# Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages
16-
permissions:
17-
contents: read
18-
pages: write
19-
id-token: write
20-
2115
# Allow only one concurrent deployment, skipping runs queued between the run in-progress and latest queued.
2216
# However, do NOT cancel in-progress runs as we want to allow these production deployments to complete.
2317
concurrency:
@@ -27,6 +21,9 @@ concurrency:
2721
jobs:
2822
# Build job
2923
build:
24+
permissions:
25+
contents: read
26+
3027
runs-on: ubuntu-latest
3128
env:
3229
MDBOOK_VERSION: 0.4.36
@@ -52,6 +49,12 @@ jobs:
5249
environment:
5350
name: github-pages
5451
url: ${{ steps.deployment.outputs.page_url }}
52+
53+
# Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages
54+
permissions:
55+
pages: write
56+
id-token: write
57+
5558
runs-on: ubuntu-latest
5659
needs: build
5760
steps:

‎pages/nextjs.yml‎

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -12,12 +12,6 @@ on:
1212
# Allows you to run this workflow manually from the Actions tab
1313
workflow_dispatch:
1414

15-
# Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages
16-
permissions:
17-
contents: read
18-
pages: write
19-
id-token: write
20-
2115
# Allow only one concurrent deployment, skipping runs queued between the run in-progress and latest queued.
2216
# However, do NOT cancel in-progress runs as we want to allow these production deployments to complete.
2317
concurrency:
@@ -27,6 +21,9 @@ concurrency:
2721
jobs:
2822
# Build job
2923
build:
24+
permissions:
25+
contents: read
26+
3027
runs-on: ubuntu-latest
3128
steps:
3229
- name: Checkout
@@ -85,6 +82,12 @@ jobs:
8582
environment:
8683
name: github-pages
8784
url: ${{ steps.deployment.outputs.page_url }}
85+
86+
# Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages
87+
permissions:
88+
pages: write
89+
id-token: write
90+
8891
runs-on: ubuntu-latest
8992
needs: build
9093
steps:

‎pages/nuxtjs.yml‎

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -12,12 +12,6 @@ on:
1212
# Allows you to run this workflow manually from the Actions tab
1313
workflow_dispatch:
1414

15-
# Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages
16-
permissions:
17-
contents: read
18-
pages: write
19-
id-token: write
20-
2115
# Allow only one concurrent deployment, skipping runs queued between the run in-progress and latest queued.
2216
# However, do NOT cancel in-progress runs as we want to allow these production deployments to complete.
2317
concurrency:
@@ -27,6 +21,9 @@ concurrency:
2721
jobs:
2822
# Build job
2923
build:
24+
permissions:
25+
contents: read
26+
3027
runs-on: ubuntu-latest
3128
steps:
3229
- name: Checkout
@@ -82,6 +79,12 @@ jobs:
8279
environment:
8380
name: github-pages
8481
url: ${{ steps.deployment.outputs.page_url }}
82+
83+
# Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages
84+
permissions:
85+
pages: write
86+
id-token: write
87+
8588
runs-on: ubuntu-latest
8689
needs: build
8790
steps:

‎pages/static.yml‎

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -9,12 +9,6 @@ on:
99
# Allows you to run this workflow manually from the Actions tab
1010
workflow_dispatch:
1111

12-
# Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages
13-
permissions:
14-
contents: read
15-
pages: write
16-
id-token: write
17-
1812
# Allow only one concurrent deployment, skipping runs queued between the run in-progress and latest queued.
1913
# However, do NOT cancel in-progress runs as we want to allow these production deployments to complete.
2014
concurrency:
@@ -27,6 +21,13 @@ jobs:
2721
environment:
2822
name: github-pages
2923
url: ${{ steps.deployment.outputs.page_url }}
24+
25+
# Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages
26+
permissions:
27+
contents: read
28+
pages: write
29+
id-token: write
30+
3031
runs-on: ubuntu-latest
3132
steps:
3233
- name: Checkout

0 commit comments

Comments
 (0)