Skip to content

Commit f9aa179

Browse files
chenjiahanchenjiahan
authored
ci: declare minimal permissions for Actions (#9018)
* ci: declare minimal permissions for Actions * fix
1 parent 54ddde8 commit f9aa179

10 files changed

Lines changed: 48 additions & 20 deletions

File tree

‎.github/workflows/ci.yml‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,10 @@ concurrency:
3030
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
3131
cancel-in-progress: ${{ github.ref_name != 'main' }}
3232

33+
permissions:
34+
# Allow commenting on issues for `reusable-build.yml`
35+
issues: write
36+
3337
jobs:
3438
get-runner-labels:
3539
name: Get Runner Labels
@@ -361,8 +365,7 @@ jobs:
361365

362366
failure_notification:
363367
name: Failure Notification
364-
needs:
365-
[test-linux, test-windows, test-mac, rust_check, rust_test]
368+
needs: [test-linux, test-windows, test-mac, rust_check, rust_test]
366369
if: ${{ failure() && !cancelled() && github.ref_name == 'main' && github.repository_owner == 'web-infra-dev' }}
367370
runs-on: ubuntu-latest
368371
steps:

‎.github/workflows/ecosystem-benchmark.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,12 @@ on:
1616
tags-ignore:
1717
- "**"
1818

19+
permissions:
20+
# Allow commenting on commits
21+
contents: write
22+
# Allow commenting on issues
23+
issues: write
24+
1925
jobs:
2026
get-runner-labels:
2127
name: Get Runner Labels

‎.github/workflows/ecosystem-ci.yml‎

Lines changed: 11 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,12 @@ on:
3434
tags-ignore:
3535
- "**"
3636

37+
permissions:
38+
# Allow commenting on commits
39+
contents: write
40+
# Allow commenting on issues
41+
issues: write
42+
3743
jobs:
3844
get-runner-labels:
3945
name: Get Runner Labels
@@ -121,17 +127,17 @@ jobs:
121127
fail-fast: false
122128
name: eco-ci (${{ matrix.suite }})
123129
runs-on: ubuntu-22.04
124-
# runs-on: ${{ fromJSON(needs.get-runner-labels.outputs.LINUX_RUNNER_LABELS) }}
130+
# runs-on: ${{ fromJSON(needs.get-runner-labels.outputs.LINUX_RUNNER_LABELS) }}
125131
steps:
126132
- name: Checkout
127133
uses: actions/checkout@v4
128134
with:
129135
ref: ${{ github.event_name == 'workflow_dispatch' && format('refs/pull/{0}/head', inputs.pr) || github.sha }}
130136

131-
# - name: Clean
132-
# uses: ./.github/actions/clean
133-
# with:
134-
# target: x86_64-unknown-linux-gnu
137+
# - name: Clean
138+
# uses: ./.github/actions/clean
139+
# with:
140+
# target: x86_64-unknown-linux-gnu
135141

136142
- name: Download bindings
137143
uses: ./.github/actions/download-artifact

‎.github/workflows/label-auto-comment.yml‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -8,17 +8,19 @@ on:
88

99
permissions:
1010
contents: read
11+
# for `actions-cool/issues-helper` to update issues
12+
issues: write
13+
# for `actions-cool/issues-helper` to update PRs
14+
pull-requests: write
1115

1216
jobs:
1317
issue-labeled:
1418
permissions:
15-
issues: write # for actions-cool/issues-helper to update issues
16-
pull-requests: write # for actions-cool/issues-helper to update PRs
1719
runs-on: ubuntu-latest
1820
steps:
1921
- name: 🤔 Need Reproduce
2022
if: github.event.label.name == 'need reproduction'
21-
uses: actions-cool/issues-helper@v3
23+
uses: actions-cool/issues-helper@v3.6.0
2224
with:
2325
actions: "create-comment"
2426
token: ${{ secrets.GITHUB_TOKEN }}
@@ -27,7 +29,7 @@ jobs:
2729
Hello @${{ github.event.issue.user.login }}, sorry we can't investigate the problem further without reproduction demo, please provide a repro demo by forking [rspack-repro](https://github.com/web-infra-dev/rspack-repro), or provide a minimal GitHub repository by yourself. Issues labeled by `need reproduction` will be closed if no activities in 14 days.
2830
- name: invalid
2931
if: github.event.label.name == 'invalid'
30-
uses: actions-cool/issues-helper@v3
32+
uses: actions-cool/issues-helper@v3.6.0
3133
with:
3234
actions: "create-comment,close-issue"
3335
token: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/lint-pr.yaml‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,13 +6,19 @@ on:
66
- opened
77
- edited
88

9+
permissions:
10+
# Allow `github/issue-labeler` to add labels
11+
issues: write
12+
# Allow `amannn/action-semantic-pull-request` to read pull requests
13+
pull-requests: read
14+
915
jobs:
1016
lint-pr-title:
1117
name: Validate PR title
1218
runs-on: ubuntu-latest
1319
steps:
1420
# https://github.com/amannn/action-semantic-pull-request
15-
- uses: amannn/action-semantic-pull-request@v5
21+
- uses: amannn/action-semantic-pull-request@v5.5.3
1622
env:
1723
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
1824
with:

‎.github/workflows/preview-commit.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,10 @@ name: Preview Commit
44
on:
55
workflow_call:
66

7+
permissions:
8+
# Allow commenting on issues for `reusable-build.yml`
9+
issues: write
10+
711
jobs:
812
get-runner-labels:
913
name: Get Runner Labels

‎.github/workflows/release-canary.yml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,8 @@ on:
1919
permissions:
2020
# To publish packages with provenance
2121
id-token: write
22+
# Allow commenting on issues for `reusable-build.yml`
23+
issues: write
2224

2325
jobs:
2426
get-runner-labels:
@@ -96,5 +98,4 @@ jobs:
9698
./x version snapshot
9799
./x publish snapshot --tag canary
98100
env:
99-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
100101
NPM_TOKEN: ${{ secrets.RSPACK_CANARY_RELEASE_TOKEN }}

‎.github/workflows/release.yml‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -106,7 +106,6 @@ jobs:
106106
run: |
107107
./x publish stable --tag ${{inputs.tag}} ${{inputs.dry_run && '--dry-run' || '--no-dry-run'}} ${{inputs.push_tags && '--push-tags' || '--no-push-tags'}}
108108
env:
109-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
110109
NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
111110
REPOSITORY: ${{ github.repository }}
112111
REF: ${{ github.ref }}

‎.github/workflows/reusable-build.yml‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,10 @@ on:
6262
required: false
6363
type: string
6464

65+
permissions:
66+
# Allow commenting on issues
67+
issues: write
68+
6569
jobs:
6670
build:
6771
name: Build
@@ -386,7 +390,7 @@ jobs:
386390
### Note that, We can't merge this script, because this script only runs on main branch
387391
- name: Update main branch test compatibility metric
388392
if: ${{ github.repository_owner == 'web-infra-dev' && inputs.target == 'x86_64-unknown-linux-gnu' && github.ref_name == 'main' && matrix.node == '18' && !inputs.skipable }}
389-
run: node ./tests/webpack-test/scripts/generate.js ${{ secrets.GITHUB_TOKEN }} ${{ github.sha }}
393+
run: node ./tests/webpack-test/scripts/generate.js ${{ github.sha }}
390394

391395
# ### update metric diff against main branch when pull request change
392396
- name: Update

‎tests/webpack-test/scripts/generate.js‎

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -2,11 +2,8 @@ const fs = require("fs");
22
const path = require("path");
33
const { run } = require("./utils");
44

5-
const GITHUB_ACTOR = process.env.GITHUB_ACTOR;
6-
const [, , token, commit_sha] = process.argv;
7-
const repoUrl = token
8-
? `https://${GITHUB_ACTOR}:${token}@github.com/web-infra-dev/rspack.git`
9-
: "https://github.com/web-infra-dev/rspack";
5+
const [, , commit_sha] = process.argv;
6+
const repoUrl = 'https://github.com/web-infra-dev/rspack.git';
107

118
(async () => {
129
const rootDir = path.resolve(__dirname, "../../../");

0 commit comments

Comments
 (0)