8000 Merge pull request #24579 from QuLogic/action-permissions · matplotlib/matplotlib@24f9128 · GitHub
[go: up one dir, main page]
Skip to content

Commit 24f9128

Browse files
tacaswelltacaswell
authored
Merge pull request #24579 from QuLogic/action-permissions
Add explicit permissions to GitHub Actions
2 parents 5bd9fdf + feec9c5 commit 24f9128

10 files changed

+46
-2
lines changed

‎.circleci/config.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -229,4 +229,6 @@ workflows:
229229
version: 2
230230
build:
231231
jobs:
232+
# NOTE: If you rename this job, then you must update the `if` condition
233+
# and `circleci-jobs` option in `.github/workflows/circleci.yml`.
232234
- docs-python38

‎.github/workflows/cibuildsdist.yml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
---
12
name: Build CI sdist and wheel
23

34
on:
@@ -17,6 +18,9 @@ on:
1718
- reopened
1819
- labeled
1920

21+
permissions:
22+
contents: read
23+
2024
jobs:
2125
build_sdist:
2226
if: |

‎.github/workflows/cibuildwheel.yml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
---
12
name: Build CI wheels
23

34
on:
@@ -17,6 +18,9 @@ on:
1718
- reopened
1819
- labeled
1920

21+
permissions:
22+
contents: read
23+
2024
jobs:
2125
build_wheels:
2226
if: |

‎.github/workflows/circleci.yml

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,11 @@
1+
---
12
on: [status]
3+
permissions:
4+
statuses: write
25
jobs:
36
circleci_artifacts_redirector_job:
47
runs-on: ubuntu-latest
8+
if: "${{ github.event.context == 'ci/circleci: docs-python38' }}"
59
name: Run CircleCI artifacts redirector
610
steps:
711
- name: GitHub Action step
@@ -11,3 +15,7 @@ jobs:
1115
artifact-path: 0/doc/build/html/index.html
1216
circleci-jobs: docs-python38
1317
job-title: View the built docs
18+
- name: Check the URL
19+
if: github.event.status != 'pending'
20+
run: |
21+
curl --fail ${{ steps.step1.outputs.url }} | grep $GITHUB_SHA

‎.github/workflows/clean_pr.yml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,10 @@
1+
---
12
name: PR cleanliness
23
on: [pull_request]
34

5+
permissions:
6+
contents: read
7+
48
jobs:
59
pr_clean:
610
runs-on: ubuntu-latest

‎.github/workflows/conflictcheck.yml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
---
12
name: "Maintenance"
23
on:
34
# So that PRs touching the same files as the push are updated
@@ -8,6 +9,9 @@ on:
89
pull_request_target:
910
types: [synchronize]
1011

12+
permissions:
13+
pull-requests: write
14+
1115
jobs:
1216
main:
1317
runs-on: ubuntu-latest

‎.github/workflows/nightlies.yml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,9 @@ on:
77
# Run on demand with workflow dispatch
88
workflow_dispatch:
99

10+
permissions:
11+
actions: read
12+
1013
jobs:
1114
upload_nightly_wheels:
1215
name: Upload nightly wheels to Anaconda Cloud

‎.github/workflows/pr_welcome.yml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,11 @@
1+
---
12
name: PR Greetings
23

34
on: [pull_request_target]
45

6+
permissions:
7+
pull-requests: write
8+
59
jobs:
610
greeting:
711
runs-on: ubuntu-latest

‎.github/workflows/reviewdog.yml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,12 @@
1+
---
12
name: Linting
23
on: [pull_request]
34

5+
permissions:
6+
contents: read
7+
checks: write
8+
pull-requests: write
9+
410
jobs:
511
flake8:
612
name: flake8

‎.github/workflows/tests.yml

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
---
12
name: Tests
23
concurrency:
34
group: ${{ github.workflow }}-${{ github.event.number }}-${{ github.event.ref }}
@@ -25,6 +26,8 @@ env:
2526
jobs:
2627
test:
2728
if: "github.event_name == 'workflow_dispatch' || github.repository == 'matplotlib/matplotlib' && !contains(github.event.head_commit.message, '[ci skip]') && !contains(github.event.head_commit.message, '[skip ci]') && !contains(github.event.head_commit.message, '[skip github]')"
29+
permissions:
30+
contents: read
2831
name: "Python ${{ matrix.python-version }} on ${{ matrix.os }} ${{ matrix.name-suffix }}"
2932
runs-on: ${{ matrix.os }}
3033

@@ -285,9 +288,11 @@ jobs:
285288

286289
# Separate dependent job to only upload one issue from the matrix of jobs
287290
create-issue:
288-
runs-on: ubuntu-latest
289-
needs: [test]
290291
if: ${{ failure() && github.event_name == 'schedule' }}
292+
needs: [test]
293+
permissions:
294+
issues: write
295+
runs-on: ubuntu-latest
291296
name: "Create issue on failure"
292297

293298
steps:

0 commit comments

Comments
 (0)
0