[GitHub] Set top level token permission

[marbre]

No description provided.

[llvmbot]

@llvm/pr-subscribers-github-workflow

Author: Marius Brehler (marbre)

Changes

---

Full diff: https://github.com/llvm/llvm-project/pull/87326.diff

1 Files Affected:

• (modified) .github/workflows/pr-code-format.yml (+4)

diff --git a/.github/workflows/pr-code-format.yml b/.github/workflows/pr-code-format.yml
index 10b18f245d8965..983838858ba43e 100644
--- a/.github/workflows/pr-code-format.yml
+++ b/.github/workflows/pr-code-format.yml
@@ -1,4 +1,8 @@
 name: "Check code formatting"
+
+permissions:
+  contents: read
+
 on:
   pull_request:
     branches:

[marbre]

Without explicitly setting the token permission, the default (read/write for all scopes) kicks in, if not changed for the entire repo, see https://github.blog/changelog/2021-04-20-github-actions-control-permissions-for-github_token.

[tru]

This seems reasonable of course, but as always with these kinds of changes - It's really hard to test ahead of time to make sure it doesn't break anything. Have you tested this in your fork?

[marbre]

This seems reasonable of course, but as always with these kinds of changes - It's really hard to test ahead of time to make sure it doesn't break anything. Have you tested this in your fork?

So far I've checked what actions are used within the workflow, but this cannot be considered at testing ahead. I had in mind that this workflow isn't that critical and that it is partly ignored (if I remember one of the pre-merge check discussions correctly). However, I converted this PR to a draft PR and will take a closer look and test within my fork.

[boomanaiden154]

LGTM. I agree with your analysis that this shouldn't fail by changing this, but always good to test. Getting the test setup working can be a little difficult, so if you run into any non-trivial issues, let me now and hopefully I can assist.

[tstellar]

@marbre Are you planning to commit this?

[marbre]

@marbre Are you planning to commit this?

After @tru's feedback I planned to take a more careful look before commiting this. Unfortunately, I had other things on my list last week and I am currently at EuroLLVM.
However, if you think that we shouldn't care too much if things break by the patch and if it would be okay to fix it afterwards we can already go ahead with this.

[tstellar]

Now that we are using the pull_request event for the code format job, any changes to it will get tested in the job that is triggered by this PR, so this has already been tested.