Add explicit permissions blocks so the default token can drop to read - #53
Add explicit permissions blocks so the default token can drop to read#53mmcky wants to merge 1 commit into
Conversation
Transcribes what the sibling repos already carry: ci and collab get contents:read + pull-requests:write (the Netlify preview comment), publish gets contents:write (peaceiris gh-pages push) + actions:read (cache artifact download). linkcheck and cache write nothing with GITHUB_TOKEN and need no block. A job with a permissions block drops unlisted scopes to none, so this is safe to merge before or after the repo-level flip -- and it is what makes the flip safe. Part of QuantEcon/meta#347 item 4. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
✅ Deploy Preview for timely-seahorse-68815c ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
There was a problem hiding this comment.
Pull request overview
This PR prepares the repository for switching the default GITHUB_TOKEN permissions to read by adding explicit permissions: blocks to workflows that rely on elevated scopes (publishing to gh-pages and posting Netlify preview comments).
Changes:
- Add workflow-level
permissions:topublish.ymlto allowgh-pagesdeployment and cross-workflow artifact download. - Add job-level
permissions:toci.ymlandcollab.ymlintended to support Netlify PR preview comments with reduced default token permissions.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| .github/workflows/publish.yml | Adds explicit workflow permissions for gh-pages publishing and artifact download. |
| .github/workflows/collab.yml | Adds job-level permissions for PR preview/comment workflows (but needs actions: read for artifact download). |
| .github/workflows/ci.yml | Adds job-level permissions for PR preview/comment workflows (but needs actions: read for artifact download). |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| permissions: | ||
| contents: read | ||
| pull-requests: write |
There was a problem hiding this comment.
Addressed — this PR was superseded by #54, whose consolidated block for ci.yml includes actions: read.
| permissions: | ||
| contents: write # peaceiris/actions-gh-pages pushes the built site to gh-pages | ||
| actions: read # dawidd6/action-download-artifact reads the cache.yml build artifact |
There was a problem hiding this comment.
Fair catch, and now addressed in #55 — linkcheck.yml gets the same contents: read + actions: read block. For the record the download works today without it (public-repo Actions reads accept a token without the scope — the sibling repos' ci workflows rely on the same leniency), so #55 is consistency hardening rather than a live fix.
| permissions: | ||
| contents: read | ||
| pull-requests: write |
There was a problem hiding this comment.
Addressed — this PR was superseded by #54, whose consolidated block for collab.yml includes actions: read.
…#54) Lands #51, #52, #53 and #50 as one change, and salvages the -n flag from #25. - runs-on: disk=large -> volume=80gb, plus spot=false, on all four GPU workflows. Now matches lecture-jax and lecture-python.myst byte for byte, allowing for collab.yml's different image. - Explicit permissions blocks on ci.yml, collab.yml and publish.yml so the default workflow token can drop to read. ci.yml and collab.yml also gain actions: read, which #53 declared only on publish.yml. - dawidd6/action-download-artifact -> @v21 at all four call sites; collab.yml was still on v3 while the rest were on v9. - -n added to the ci.yml PDF build so it matches publish.yml, closing a gap where a nitpick-class error passed the PR check and failed at publish time. #51, #52 and #53 conflicted pairwise over the same region of ci.yml and collab.yml, so they are resolved once here rather than through two sequential rebases. Part of the rollout tracked in QuantEcon/meta#330, with the permissions work from QuantEcon/meta#347. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
|
Landed via #54, with one addition. This PR declared Worth recording that the omission was not actually breaking. lecture-jax's Merged in #54 rather than here because this PR, #51 and #52 conflicted pairwise over the same region of |
#55) Completes the hardening #54 landed for ci, collab and publish: the dawidd6 cache download works today via public-repo API leniency, but granting actions: read explicitly matches the documented requirement and the blocks the other workflows now carry. Raised by Copilot on the superseded #53. Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Preparation for QuantEcon/meta#347 item 4 (default workflow token permissions →
read). This repo currently has nopermissions:block in any workflow, so three workflows rely on the repo-levelwritedefault; flipping the setting without these blocks would break publishing.The blocks transcribe what the sibling lecture repos already carry:
ci.ymlandcollab.ymlgetcontents: read+pull-requests: write(whatnwtgck/actions-netlifyneeds for the preview comment — the same block aslecture-jax/ci.yml), andpublish.ymlgetscontents: write(thepeaceiris/actions-gh-pagespush) +actions: read(thedawidd6/action-download-artifactcache download — the same scopeslecture-jax/publish.ymlgrants them).linkcheck.ymlandcache.ymlwrite nothing withGITHUB_TOKENand need no block. The notebooks sync usesQUANTECON_SERVICES_PATand is unaffected.Once a job carries a
permissions:block, unlisted scopes drop tononeregardless of the repo default — so this merges safely before or after the settings flip, and it is what makes the flip safe to do.No conflict with #52 — different lines in the same files; whichever merges second picks both changes up cleanly.
🤖 Generated with Claude Code