Skip to content

Commit 3d5676e

Browse files
caugnercaugner
authored
fix(workflows): assign explicit permissions (#13241)
* ci(workflows): assign explicit permissions * chore(workflows): remove ripgrep notes
1 parent bdb7ee8 commit 3d5676e

20 files changed

+52
-16
lines changed

‎.github/workflows/auto-merge.yml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,9 @@ on:
55
branches:
66
- main
77

8+
# No GITHUB_TOKEN permissions, as we use AUTOMERGE_TOKEN instead.
9+
permissions: {}
10+
811
jobs:
912
auto-merge:
1013
runs-on: ubuntu-latest

‎.github/workflows/dev-build.yml

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -115,7 +115,6 @@ jobs:
115115
- name: Install all yarn packages
116116
run: yarn --frozen-lockfile
117117
env:
118-
# https://github.com/microsoft/vscode-ripgrep#github-api-limit-note
119118
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
120119

121120
- name: Install Python

‎.github/workflows/developing.yml

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,9 @@ name: Developing with Yari
33
on:
44
pull_request:
55

6+
# No GITHUB_TOKEN permissions, as we only use it to increase API limit.
7+
permissions: {}
8+
69
jobs:
710
build:
811
runs-on: ubuntu-latest
@@ -20,7 +23,6 @@ jobs:
2023
- name: Install all yarn packages
2124
run: yarn --frozen-lockfile
2225
env:
23-
# https://github.com/microsoft/vscode-ripgrep#github-api-limit-note
2426
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
2527

2628
- name: Setup kernel for react native, increase watchers

‎.github/workflows/glean-probe-scraper.yml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,9 @@ on:
66
- main
77
pull_request:
88

9+
# No GITHUB_TOKEN permissions, as we don't use it.
10+
permissions: {}
11+
912
jobs:
1013
glean-probe-scraper:
1114
if: github.repository == 'mdn/yari'

‎.github/workflows/labeler.yml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,10 @@ name: "Pull Request Labeler"
22
on:
33
- pull_request_target
44

5+
permissions:
6+
contents: read
7+
pull-requests: write
8+
59
jobs:
610
triage:
711
runs-on: ubuntu-latest

‎.github/workflows/mark-as-idle-issues-pr.yml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,12 @@ on:
33
schedule:
44
- cron: "49 11,23 * * *"
55

6+
permissions:
7+
# Label issues.
8+
issues: write
9+
# Label pull requests.
10+
pull-requests: write
11+
612
jobs:
713
idle-issues-prs:
814
uses: mdn/workflows/.github/workflows/idle.yml@main

‎.github/workflows/new-issues.yml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,10 @@ on:
55
- reopened
66
- opened
77

8+
permissions:
9+
# Label issues.
10+
issues: write
11+
812
jobs:
913
label-new-issues:
1014
uses: mdn/workflows/.github/workflows/new-issues.yml@main

‎.github/workflows/npm-publish.yml

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,6 @@ jobs:
3434
if: steps.release.outputs.release_created
3535
run: yarn --frozen-lockfile
3636
env:
37-
# https://github.com/microsoft/vscode-ripgrep#github-api-limit-note
3837
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
3938

4039
- name: Build

‎.github/workflows/npm-published-simulation.yml

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,9 @@ on:
88
branches:
99
- main
1010

11+
# No GITHUB_TOKEN permissions, as we only use it to increase API limit.
12+
permissions: {}
13+
1114
jobs:
1215
build:
1316
runs-on: ubuntu-latest
@@ -29,7 +32,6 @@ jobs:
2932
working-directory: mdn/yari
3033
run: yarn --frozen-lockfile
3134
env:
32-
# https://github.com/microsoft/vscode-ripgrep#github-api-limit-note
3335
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
3436

3537
- name: Setup kernel for react native, increase watchers

‎.github/workflows/performance.yml

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,9 @@ on:
88
- package.json
99
- yarn.lock
1010

11+
# No GITHUB_TOKEN permissions, as we only use it to increase API limit.
12+
permissions: {}
13+
1114
jobs:
1215
lighthouse:
1316
runs-on: ubuntu-latest
@@ -38,7 +41,6 @@ jobs:
3841
working-directory: mdn/yari
3942
run: yarn --frozen-lockfile
4043
env:
41-
# https://github.com/microsoft/vscode-ripgrep#github-api-limit-note
4244
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
4345

4446
- name: Build select important pages

0 commit comments

Comments
 (0)