From f057fdbac5bfead1825a837aa638909eaf3b434e Mon Sep 17 00:00:00 2001 From: Alex Skrypnyk Date: Thu, 16 Jul 2026 12:17:52 +1000 Subject: [PATCH 1/5] [#2794] Added 'pull-requests: read' permission to deploy job for 'gh pr view'. --- .github/workflows/build-test-deploy.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/build-test-deploy.yml b/.github/workflows/build-test-deploy.yml index 979b06f42..529fa0cc2 100644 --- a/.github/workflows/build-test-deploy.yml +++ b/.github/workflows/build-test-deploy.yml @@ -624,6 +624,10 @@ jobs: if: ${{ !cancelled() && (inputs.deploy_target || (success() && github.event_name != 'schedule' && !startsWith(github.head_ref || github.ref_name, 'deps/') && (github.event_name == 'push' || !startsWith(github.head_ref, 'project/')))) }} #;> !PROVISION_TYPE_PROFILE + permissions: + contents: read # Check out the repository. + pull-requests: read # 'gh pr view' resolves the PR head SHA and branch. + container: # https://hub.docker.com/r/drevops/ci-runner image: drevops/ci-runner:26.6.0@sha256:190027056cac7b7ce28c29a1e5494779ebadc4ee8e95d468b75bc56e7be5aabd From 4b9eb0c095683cb7f166ec6a25292aadbb22ec3a Mon Sep 17 00:00:00 2001 From: Alex Skrypnyk Date: Thu, 16 Jul 2026 12:18:14 +1000 Subject: [PATCH 2/5] Updated snapshots. --- .../_baseline/.github/workflows/build-test-deploy.yml | 4 ++++ .../.github/workflows/build-test-deploy.yml | 6 +++++- .../.github/workflows/build-test-deploy.yml | 4 ++-- 3 files changed, 11 insertions(+), 3 deletions(-) diff --git a/.vortex/installer/tests/Fixtures/handler_process/_baseline/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/_baseline/.github/workflows/build-test-deploy.yml index 4fc4c4fc4..4c44c0c1a 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/_baseline/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/_baseline/.github/workflows/build-test-deploy.yml @@ -539,6 +539,10 @@ jobs: needs: [build, lint] if: ${{ !cancelled() && (inputs.deploy_target || (success() && github.event_name != 'schedule' && !startsWith(github.head_ref || github.ref_name, 'deps/') && (github.event_name == 'push' || !startsWith(github.head_ref, 'project/')))) }} + permissions: + contents: read # Check out the repository. + pull-requests: read # 'gh pr view' resolves the PR head SHA and branch. + container: # https://hub.docker.com/r/drevops/ci-runner image: drevops/ci-runner:__VERSION__ diff --git a/.vortex/installer/tests/Fixtures/handler_process/deploy_types_none_gha/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/deploy_types_none_gha/.github/workflows/build-test-deploy.yml index e15b81f5f..ab6d3cfbc 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/deploy_types_none_gha/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/deploy_types_none_gha/.github/workflows/build-test-deploy.yml @@ -1,4 +1,4 @@ -@@ -533,100 +533,3 @@ +@@ -533,104 +533,3 @@ timeout-minutes: 120 # Cancel the action after 120 minutes, regardless of whether a connection has been established. with: detached: true @@ -8,6 +8,10 @@ - needs: [build, lint] - if: ${{ !cancelled() && (inputs.deploy_target || (success() && github.event_name != 'schedule' && !startsWith(github.head_ref || github.ref_name, 'deps/') && (github.event_name == 'push' || !startsWith(github.head_ref, 'project/')))) }} - +- permissions: +- contents: read # Check out the repository. +- pull-requests: read # 'gh pr view' resolves the PR head SHA and branch. +- - container: - # https://hub.docker.com/r/drevops/ci-runner - image: drevops/ci-runner:__VERSION__ diff --git a/.vortex/installer/tests/Fixtures/handler_process/provision_profile/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/provision_profile/.github/workflows/build-test-deploy.yml index f815bff4a..048b5071e 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/provision_profile/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/provision_profile/.github/workflows/build-test-deploy.yml @@ -185,5 +185,5 @@ needs: [build, lint] - if: ${{ !cancelled() && (inputs.deploy_target || (success() && github.event_name != 'schedule' && !startsWith(github.head_ref || github.ref_name, 'deps/') && (github.event_name == 'push' || !startsWith(github.head_ref, 'project/')))) }} - container: - # https://hub.docker.com/r/drevops/ci-runner + permissions: + contents: read # Check out the repository. From 7297642643caec806d222310cf0013ee608342d7 Mon Sep 17 00:00:00 2001 From: Alex Skrypnyk Date: Thu, 16 Jul 2026 12:51:04 +1000 Subject: [PATCH 3/5] [#2794] Removed inline comments from 'permissions' entries in 'build-test-deploy.yml'. --- .github/workflows/build-test-deploy.yml | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/build-test-deploy.yml b/.github/workflows/build-test-deploy.yml index 529fa0cc2..d8c2ea552 100644 --- a/.github/workflows/build-test-deploy.yml +++ b/.github/workflows/build-test-deploy.yml @@ -77,7 +77,7 @@ env: DOCKER_CONFIG: /tmp/.docker permissions: - contents: read # Minimal default for all jobs; jobs that need more override below. + contents: read jobs: @@ -334,9 +334,9 @@ jobs: #;> !PROVISION_TYPE_PROFILE permissions: - contents: read # Check out the repository. - checks: write # Publish test results to the Checks tab. - pull-requests: write # Comment on the pull request. + contents: read + checks: write + pull-requests: write strategy: # A matrix to run multiple jobs in parallel. @@ -625,8 +625,8 @@ jobs: #;> !PROVISION_TYPE_PROFILE permissions: - contents: read # Check out the repository. - pull-requests: read # 'gh pr view' resolves the PR head SHA and branch. + contents: read + pull-requests: read container: # https://hub.docker.com/r/drevops/ci-runner From 6efb4cc7ff2b3b8f048ddaa853914d92ff9e9fb2 Mon Sep 17 00:00:00 2001 From: Alex Skrypnyk Date: Thu, 16 Jul 2026 12:51:19 +1000 Subject: [PATCH 4/5] Updated snapshots. --- .../.github/workflows/build-test-deploy.yml | 12 ++++++------ .../.github/workflows/build-test-deploy.yml | 4 ++-- .../.github/workflows/build-test-deploy.yml | 4 ++-- 3 files changed, 10 insertions(+), 10 deletions(-) diff --git a/.vortex/installer/tests/Fixtures/handler_process/_baseline/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/_baseline/.github/workflows/build-test-deploy.yml index 4c44c0c1a..d2cb1c197 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/_baseline/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/_baseline/.github/workflows/build-test-deploy.yml @@ -66,7 +66,7 @@ env: DOCKER_CONFIG: /tmp/.docker permissions: - contents: read # Minimal default for all jobs; jobs that need more override below. + contents: read jobs: @@ -289,9 +289,9 @@ jobs: if: ${{ !inputs.deploy_target && github.event_name != 'schedule' && (github.event_name == 'push' || !startsWith(github.head_ref, 'project/')) }} permissions: - contents: read # Check out the repository. - checks: write # Publish test results to the Checks tab. - pull-requests: write # Comment on the pull request. + contents: read + checks: write + pull-requests: write strategy: # A matrix to run multiple jobs in parallel. @@ -540,8 +540,8 @@ jobs: if: ${{ !cancelled() && (inputs.deploy_target || (success() && github.event_name != 'schedule' && !startsWith(github.head_ref || github.ref_name, 'deps/') && (github.event_name == 'push' || !startsWith(github.head_ref, 'project/')))) }} permissions: - contents: read # Check out the repository. - pull-requests: read # 'gh pr view' resolves the PR head SHA and branch. + contents: read + pull-requests: read container: # https://hub.docker.com/r/drevops/ci-runner diff --git a/.vortex/installer/tests/Fixtures/handler_process/deploy_types_none_gha/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/deploy_types_none_gha/.github/workflows/build-test-deploy.yml index ab6d3cfbc..8bab2c6c2 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/deploy_types_none_gha/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/deploy_types_none_gha/.github/workflows/build-test-deploy.yml @@ -9,8 +9,8 @@ - if: ${{ !cancelled() && (inputs.deploy_target || (success() && github.event_name != 'schedule' && !startsWith(github.head_ref || github.ref_name, 'deps/') && (github.event_name == 'push' || !startsWith(github.head_ref, 'project/')))) }} - - permissions: -- contents: read # Check out the repository. -- pull-requests: read # 'gh pr view' resolves the PR head SHA and branch. +- contents: read +- pull-requests: read - - container: - # https://hub.docker.com/r/drevops/ci-runner diff --git a/.vortex/installer/tests/Fixtures/handler_process/provision_profile/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/provision_profile/.github/workflows/build-test-deploy.yml index 048b5071e..8e0bd17ab 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/provision_profile/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/provision_profile/.github/workflows/build-test-deploy.yml @@ -133,7 +133,7 @@ - if: ${{ !inputs.deploy_target && github.event_name != 'schedule' && (github.event_name == 'push' || !startsWith(github.head_ref, 'project/')) }} permissions: - contents: read # Check out the repository. + contents: read @@ -312,14 +199,6 @@ VORTEX_SSH_DISABLE_STRICT_HOST_KEY_CHECKING: "1" VORTEX_SSH_REMOVE_ALL_KEYS: "1" @@ -186,4 +186,4 @@ - if: ${{ !cancelled() && (inputs.deploy_target || (success() && github.event_name != 'schedule' && !startsWith(github.head_ref || github.ref_name, 'deps/') && (github.event_name == 'push' || !startsWith(github.head_ref, 'project/')))) }} permissions: - contents: read # Check out the repository. + contents: read From f7dff2304a95f98bc8f6712caeb1c3a5853e667a Mon Sep 17 00:00:00 2001 From: Alex Skrypnyk Date: Thu, 16 Jul 2026 13:17:33 +1000 Subject: [PATCH 5/5] Re-triggered CI to clear a flaky check.