Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix: workflow permissions #54

Merged
merged 10 commits into from
Mar 16, 2023
Merged

fix: workflow permissions #54

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
04641a1
change top level token permissions in pr-title workflow
chris3ware Mar 15, 2023
d90ef24
change top level token permissions in lint workflow
chris3ware Mar 15, 2023
e95aad0
remove job level permissions from get-terraform-dir workflow
chris3ware Mar 15, 2023
f5dd60e
upgrade get-terraform-dir to latest release
chris3ware Mar 15, 2023
0ae7856
change get-terraform-dir to previous working version
chris3ware Mar 15, 2023
b1a8861
add job level read permissions to get-terraform-dir
chris3ware Mar 15, 2023
064ed21
set `persist-credentials: true` in checkout step of get-terraform-dir
chris3ware Mar 15, 2023
90d2060
set `persist-credentials: true` in checkout step of lint workflow
chris3ware Mar 15, 2023
5851e60
change top level permissions to `contents: read` for tfsec workflow
chris3ware Mar 15, 2023
7b0755e
change top level permissions to `contents: read` for semantic release
chris3ware Mar 15, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 2 additions & 4 deletions .github/workflows/get-terraform-dir.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,8 +12,6 @@ permissions:

jobs:
terraform-directory:
permissions:
contents: read
runs-on: ubuntu-latest
timeout-minutes: 5
outputs:
Expand All @@ -22,11 +20,11 @@ jobs:
- name: Checkout repository
uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
with:
persist-credentials: false
persist-credentials: true # changed-files unable to authenticate if false

- name: Get changed files
id: changed-files
uses: tj-actions/changed-files@04124efe7560d15e11ea2ba96c0df2989f68f1f4 # v35.6.1
uses: tj-actions/changed-files@v35.5.6

- name: List all changed files
run: |
Expand Down
9 changes: 3 additions & 6 deletions .github/workflows/lint.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,17 +10,14 @@ on:
type: number

# Declare default permissions as read only.
permissions: read-all
permissions:
contents: read

jobs:
find-terraform:
uses: ./.github/workflows/get-terraform-dir.yaml
permissions:
contents: read

lint:
permissions:
contents: read
runs-on: ubuntu-latest
timeout-minutes: 10
concurrency:
Expand All @@ -31,7 +28,7 @@ jobs:
- name: Checkout repository
uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
with:
persist-credentials: false
persist-credentials: true # lint fails to authenticate when false

- name: Setup Terraform
if: ${{ needs.find-terraform.outputs.terraform-dir != '' }}
Expand Down
5 changes: 2 additions & 3 deletions .github/workflows/pr-title.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,16 +6,15 @@ on:
workflow_call: {}

# Declare default permissions as read only.
permissions: read-all
permissions:
pull-requests: read

concurrency:
group: ${{ github.workflow }}-${{ github.head_ref }}
cancel-in-progress: true

jobs:
conventional-pr-title:
permissions:
pull-requests: read
runs-on: ubuntu-latest
timeout-minutes: 5
steps:
Expand Down
3 changes: 2 additions & 1 deletion .github/workflows/semantic-release.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,8 @@ on:
branches: [main]

# Declare default permissions as read only.
permissions: read-all
permissions:
contents: read

jobs:
get-temp-token:
Expand Down
6 changes: 2 additions & 4 deletions .github/workflows/tfsec-pr.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,18 +10,16 @@ on:
type: string

# Declare default permissions as read only.
permissions: read-all
permissions:
contents: read

jobs:
find-terraform:
permissions:
contents: read
uses: ./.github/workflows/get-terraform-dir.yaml

tfsec-pr-commenter:
permissions:
pull-requests: write
contents: read
runs-on: ubuntu-latest
timeout-minutes: 10
concurrency:
Expand Down