From 01a475af6d8ff4943fe4c91d04582120bf9b3a84 Mon Sep 17 00:00:00 2001 From: Varun Sharma Date: Sun, 10 Apr 2022 20:15:26 -0700 Subject: [PATCH] ci: Add GitHub token permissions for workflows (#34946) --- .github/workflows/compressed-size.yml | 6 ++++++ .github/workflows/issue-check-inactive.yml | 6 ++++++ .github/workflows/issue-close-require.yml | 6 ++++++ .github/workflows/issue-labeled.yml | 6 ++++++ .github/workflows/issue-open-check.yml | 7 +++++++ .github/workflows/issue-remove-inactive.yml | 6 ++++++ .github/workflows/issues-similarity-analysis.yml | 5 +++++ .github/workflows/pr-check-ci.yml | 8 ++++++++ .github/workflows/pr-check-merge.yml | 6 ++++++ .github/workflows/pr-open-check.yml | 8 ++++++++ .github/workflows/preview-build.yml | 3 +++ .github/workflows/preview-deploy.yml | 11 +++++++++++ .github/workflows/preview-start.yml | 6 ++++++ .github/workflows/rebase.yml | 6 ++++++ .github/workflows/release-helper.yml | 5 +++++ .github/workflows/site-deploy.yml | 3 +++ .github/workflows/sync-gitee.yml | 5 +++++ .github/workflows/test.yml | 3 +++ .github/workflows/ui-upload.yml | 6 ++++++ .github/workflows/ui.yml | 3 +++ .github/workflows/verify-files-modify.yml | 5 +++++ .github/workflows/verify-package-version.yml | 6 ++++++ 22 files changed, 126 insertions(+) diff --git a/.github/workflows/compressed-size.yml b/.github/workflows/compressed-size.yml index 04e8a356f9..34f234d3eb 100644 --- a/.github/workflows/compressed-size.yml +++ b/.github/workflows/compressed-size.yml @@ -9,8 +9,14 @@ concurrency: group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} cancel-in-progress: true +permissions: + contents: read + jobs: compressed-size: + permissions: + contents: read # for actions/checkout to fetch code + pull-requests: write # for preactjs/compressed-size-action to create PR comments runs-on: ubuntu-latest env: CI_JOB_NUMBER: 1 diff --git a/.github/workflows/issue-check-inactive.yml b/.github/workflows/issue-check-inactive.yml index df05004109..9a79731004 100644 --- a/.github/workflows/issue-check-inactive.yml +++ b/.github/workflows/issue-check-inactive.yml @@ -4,8 +4,14 @@ on: schedule: - cron: "0 0 */15 * *" +permissions: + contents: read + jobs: issue-check-inactive: + permissions: + issues: write # for actions-cool/issues-helper to update issues + pull-requests: write # for actions-cool/issues-helper to update PRs runs-on: ubuntu-latest steps: - name: check-inactive diff --git a/.github/workflows/issue-close-require.yml b/.github/workflows/issue-close-require.yml index 3107470326..be27eb3d86 100644 --- a/.github/workflows/issue-close-require.yml +++ b/.github/workflows/issue-close-require.yml @@ -4,8 +4,14 @@ on: schedule: - cron: "0 0 * * *" +permissions: + contents: read + jobs: issue-close-require: + permissions: + issues: write # for actions-cool/issues-helper to update issues + pull-requests: write # for actions-cool/issues-helper to update PRs runs-on: ubuntu-latest steps: - name: need reproduce diff --git a/.github/workflows/issue-labeled.yml b/.github/workflows/issue-labeled.yml index 889557feca..6fc3d2f19f 100644 --- a/.github/workflows/issue-labeled.yml +++ b/.github/workflows/issue-labeled.yml @@ -6,8 +6,14 @@ on: issues: types: [labeled] +permissions: + contents: read + jobs: issue-labeled: + permissions: + issues: write # for actions-cool/issues-helper to update issues + pull-requests: write # for actions-cool/issues-helper to update PRs runs-on: ubuntu-latest steps: - name: help wanted diff --git a/.github/workflows/issue-open-check.yml b/.github/workflows/issue-open-check.yml index 34afcd6dcd..c99f2b12be 100644 --- a/.github/workflows/issue-open-check.yml +++ b/.github/workflows/issue-open-check.yml @@ -4,8 +4,15 @@ on: issues: types: [opened] +permissions: + contents: read + jobs: issue-open-check: + permissions: + contents: read # for visiky/dingtalk-release-notify to get latest release + issues: write # for actions-cool/issues-helper to update issues + pull-requests: write # for actions-cool/issues-helper to update PRs runs-on: ubuntu-latest steps: - uses: actions-cool/check-user-permission@v2 diff --git a/.github/workflows/issue-remove-inactive.yml b/.github/workflows/issue-remove-inactive.yml index 90556c416d..d52e84f39f 100644 --- a/.github/workflows/issue-remove-inactive.yml +++ b/.github/workflows/issue-remove-inactive.yml @@ -6,8 +6,14 @@ on: issue_comment: types: [created, edited] +permissions: + contents: read + jobs: issue-remove-inactive: + permissions: + issues: write # for actions-cool/issues-helper to update issues + pull-requests: write # for actions-cool/issues-helper to update PRs runs-on: ubuntu-latest steps: - name: remove inactive diff --git a/.github/workflows/issues-similarity-analysis.yml b/.github/workflows/issues-similarity-analysis.yml index 8a378357f6..64aa8ced80 100644 --- a/.github/workflows/issues-similarity-analysis.yml +++ b/.github/workflows/issues-similarity-analysis.yml @@ -4,8 +4,13 @@ on: issues: types: [opened, edited] +permissions: + contents: read + jobs: similarity-analysis: + permissions: + issues: write # for actions-cool/issues-similarity-analysis to create issue comments runs-on: ubuntu-latest steps: - name: analysis diff --git a/.github/workflows/pr-check-ci.yml b/.github/workflows/pr-check-ci.yml index e3e608b4b5..d842bd97e7 100644 --- a/.github/workflows/pr-check-ci.yml +++ b/.github/workflows/pr-check-ci.yml @@ -5,8 +5,16 @@ on: schedule: - cron: "*/10 * * * *" +permissions: + contents: read + jobs: pr-check-ci: + permissions: + checks: read # for actions-cool/check-pr-ci to get check reference + contents: write # for actions-cool/check-pr-ci to merge PRs + issues: write # for actions-cool/check-pr-ci to update issues + pull-requests: write # for actions-cool/check-pr-ci to update PRs runs-on: ubuntu-latest steps: - uses: actions-cool/check-pr-ci@v1 diff --git a/.github/workflows/pr-check-merge.yml b/.github/workflows/pr-check-merge.yml index c2ff3d4e10..8f628af602 100644 --- a/.github/workflows/pr-check-merge.yml +++ b/.github/workflows/pr-check-merge.yml @@ -4,8 +4,14 @@ on: pull_request_target: types: [opened] +permissions: + contents: read + jobs: pr-check-merge: + permissions: + issues: write # for actions-cool/issues-helper to update issues + pull-requests: write # for actions-cool/issues-helper to update PRs runs-on: ubuntu-latest if: (github.event.pull_request.head.ref == 'feature' || github.event.pull_request.head.ref == 'master') && github.event.pull_request.head.user.login == 'ant-design' steps: diff --git a/.github/workflows/pr-open-check.yml b/.github/workflows/pr-open-check.yml index 6dfdb39ff2..19a3bed997 100644 --- a/.github/workflows/pr-open-check.yml +++ b/.github/workflows/pr-open-check.yml @@ -4,8 +4,14 @@ on: pull_request_target: types: [opened, edited, reopened, synchronize] +permissions: + contents: read + jobs: refuse: + permissions: + issues: write # for actions-cool/pr-welcome to create, update & react on issues + pull-requests: write # for actions-cool/pr-welcome to request reviewer runs-on: ubuntu-latest steps: - uses: actions-cool/pr-welcome@v1 @@ -19,6 +25,8 @@ jobs: close: true check-changelog: + permissions: + pull-requests: write # for actions-cool/pr-check-fill to create or update PR comments runs-on: ubuntu-latest steps: - name: check fill diff --git a/.github/workflows/preview-build.yml b/.github/workflows/preview-build.yml index b50497d7a1..0af77d36c4 100644 --- a/.github/workflows/preview-build.yml +++ b/.github/workflows/preview-build.yml @@ -11,6 +11,9 @@ concurrency: group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} cancel-in-progress: true +permissions: + contents: read + jobs: # Prepare node modules. Reuse cache if available setup: diff --git a/.github/workflows/preview-deploy.yml b/.github/workflows/preview-deploy.yml index 6ed0f06f05..5726bb1acc 100644 --- a/.github/workflows/preview-deploy.yml +++ b/.github/workflows/preview-deploy.yml @@ -8,8 +8,15 @@ on: types: - completed +permissions: + contents: read + jobs: deploy-site: + permissions: + actions: read # for dawidd6/action-download-artifact to query and download artifacts + issues: write # for actions-cool/maintain-one-comment to modify or create issue comments + pull-requests: write # for actions-cool/maintain-one-comment to modify or create PR comments name: deploy preview runs-on: ubuntu-latest if: > @@ -65,6 +72,10 @@ jobs: number: ${{ steps.pr.outputs.id }} build-site-failed: + permissions: + actions: read # for dawidd6/action-download-artifact to query and download artifacts + issues: write # for actions-cool/maintain-one-comment to modify or create issue comments + pull-requests: write # for actions-cool/maintain-one-comment to modify or create PR comments name: build preview failed runs-on: ubuntu-latest if: > diff --git a/.github/workflows/preview-start.yml b/.github/workflows/preview-start.yml index fdd2ad9dd6..692b09c5ed 100644 --- a/.github/workflows/preview-start.yml +++ b/.github/workflows/preview-start.yml @@ -10,8 +10,14 @@ on: pull_request_target: types: [opened, synchronize, reopened] +permissions: + contents: read + jobs: preview-start: + permissions: + issues: write # for actions-cool/maintain-one-comment to modify or create issue comments + pull-requests: write # for actions-cool/maintain-one-comment to modify or create PR comments name: start preview info runs-on: ubuntu-latest steps: diff --git a/.github/workflows/rebase.yml b/.github/workflows/rebase.yml index facf27780b..01f3942cda 100644 --- a/.github/workflows/rebase.yml +++ b/.github/workflows/rebase.yml @@ -4,8 +4,14 @@ on: issue_comment: types: [created] +permissions: + contents: read + jobs: rebase: + permissions: + contents: write # for cirrus-actions/rebase to push code to rebase + pull-requests: read # for cirrus-actions/rebase to get info about PR name: Rebase if: github.event.issue.pull_request != '' && (contains(github.event.comment.body, '/rebase') || contains(github.event.comment.body, '\rebase')) runs-on: ubuntu-latest diff --git a/.github/workflows/release-helper.yml b/.github/workflows/release-helper.yml index 05ee24a927..61723624cc 100644 --- a/.github/workflows/release-helper.yml +++ b/.github/workflows/release-helper.yml @@ -10,8 +10,13 @@ name: Release Helper on: create +permissions: + contents: read + jobs: release-helper: + permissions: + contents: write # for actions-cool/release-helper to create releases if: github.event.ref_type == 'tag' runs-on: ubuntu-latest steps: diff --git a/.github/workflows/site-deploy.yml b/.github/workflows/site-deploy.yml index 57553c24fd..f358c15171 100644 --- a/.github/workflows/site-deploy.yml +++ b/.github/workflows/site-deploy.yml @@ -4,6 +4,9 @@ name: Deploy website on: create +permissions: + contents: read + jobs: setup: runs-on: ubuntu-latest diff --git a/.github/workflows/sync-gitee.yml b/.github/workflows/sync-gitee.yml index 4b62ef4245..b9685e8dee 100644 --- a/.github/workflows/sync-gitee.yml +++ b/.github/workflows/sync-gitee.yml @@ -10,8 +10,13 @@ on: - 3.x-stable create: +permissions: + contents: read + jobs: mirror: + permissions: + contents: none runs-on: ubuntu-latest if: github.repository == 'ant-design/ant-design' steps: diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index b2884363ad..a263110e3e 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -9,6 +9,9 @@ concurrency: group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} cancel-in-progress: true +permissions: + contents: read + jobs: setup: runs-on: ubuntu-latest diff --git a/.github/workflows/ui-upload.yml b/.github/workflows/ui-upload.yml index a1c925f4be..632e53a1e8 100644 --- a/.github/workflows/ui-upload.yml +++ b/.github/workflows/ui-upload.yml @@ -8,8 +8,14 @@ on: types: - completed +permissions: + contents: read + jobs: upload-ui: + permissions: + actions: read # for dawidd6/action-download-artifact to query and download artifacts + pull-requests: read # for dawidd6/action-download-artifact to query commit hash name: deploy preview runs-on: ubuntu-latest if: > diff --git a/.github/workflows/ui.yml b/.github/workflows/ui.yml index 5484c116a0..1b70d0aa80 100644 --- a/.github/workflows/ui.yml +++ b/.github/workflows/ui.yml @@ -12,6 +12,9 @@ concurrency: group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} cancel-in-progress: true +permissions: + contents: read + jobs: test: runs-on: ubuntu-latest diff --git a/.github/workflows/verify-files-modify.yml b/.github/workflows/verify-files-modify.yml index d76777352f..bb4c0157c7 100644 --- a/.github/workflows/verify-files-modify.yml +++ b/.github/workflows/verify-files-modify.yml @@ -4,8 +4,13 @@ on: pull_request_target: types: [opened, synchronize] +permissions: + contents: read + jobs: verify: + permissions: + pull-requests: write # for actions-cool/verify-files-modify to update status of PRs runs-on: ubuntu-latest steps: - name: verify-version diff --git a/.github/workflows/verify-package-version.yml b/.github/workflows/verify-package-version.yml index 23ad7572f4..6ff6065a35 100644 --- a/.github/workflows/verify-package-version.yml +++ b/.github/workflows/verify-package-version.yml @@ -4,8 +4,14 @@ on: pull_request: types: [opened, edited, reopened, synchronize, ready_for_review] +permissions: + contents: read + jobs: verify: + permissions: + contents: read # for actions/checkout to fetch code + pull-requests: write # for actions-cool/verify-package-version to comment on PR runs-on: ubuntu-latest if: contains(github.event.pull_request.title, 'changelog') || contains(github.event.pull_request.title, 'release') steps: