Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

🌱 reduce github action permissions #408

Merged
merged 1 commit into from
Jan 8, 2024
Merged

🌱 reduce github action permissions #408

merged 1 commit into from
Jan 8, 2024

Conversation

tuminoid
Copy link
Member

@tuminoid tuminoid commented Jan 8, 2024 •
edited
Loading

contents: write is excessive right for dependabot, as we don't allow dependabot to auto-merge anything. It is enough for it to read contents and create pull request.

Move permissions from top-level to job-level as well.

Cleanup actions formatting to be the same for easier reading and maintenance. Add missing version tags.

These is highlighted by the CLOmonitor/OpenSSF Scorecard. This restores score for token permissions to 10/10.

@metal3-io-bot metal3-io-bot added the size/S Denotes a PR that changes 10-29 lines, ignoring generated files. label Jan 8, 2024
@tuminoid tuminoid force-pushed the tuomo/reduce-dependabot-rights branch from 49fdfa5 to 9fc0429 Compare January 8, 2024 11:37
@tuminoid tuminoid changed the title 🌱 reduce dependabot action permissions 🌱 reduce github action permissions Jan 8, 2024
@metal3-io-bot metal3-io-bot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/S Denotes a PR that changes 10-29 lines, ignoring generated files. labels Jan 8, 2024
This was referenced Jan 8, 2024
Merged
Merged
kashifest
kashifest reviewed Jan 8, 2024
View reviewed changes
Copy link
Member

@kashifest kashifest left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/approve

@metal3-io-bot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: kashifest

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@metal3-io-bot metal3-io-bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jan 8, 2024
@tuminoid
reduce action permissions
f54484b 
Contents: write is excessive right for dependabot, as we don't allow
dependabot to auto-merge anything. It is enough for it to read contents
and create pull request.

Move the permissions from top-level to job-level.

Cleanup actions formatting to be the same for easier reading and
maintenance.

This restores the token permissions score to 10/10.

Signed-off-by: Tuomo Tanskanen <[email protected]>
@tuminoid tuminoid force-pushed the tuomo/reduce-dependabot-rights branch from 9fc0429 to f54484b Compare January 8, 2024 11:58
@tuminoid
Copy link
Member Author

tuminoid commented Jan 8, 2024

/cc @lentzi90

@metal3-io-bot metal3-io-bot requested a review from lentzi90 January 8, 2024 12:00
@tuminoid tuminoid mentioned this pull request Jan 8, 2024
Merged
lentzi90
lentzi90 reviewed Jan 8, 2024
View reviewed changes
Copy link
Member

@lentzi90 lentzi90 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm

@metal3-io-bot metal3-io-bot added the lgtm Indicates that a PR is ready to be merged. label Jan 8, 2024
@lentzi90
Copy link
Member

lentzi90 commented Jan 8, 2024

/override test-centos-e2e-integration-main
/overrode test-ubuntu-integration-main

@metal3-io-bot
Copy link
Contributor

@lentzi90: Overrode contexts on behalf of lentzi90: test-centos-e2e-integration-main

In response to this:

/override test-centos-e2e-integration-main
/overrode test-ubuntu-integration-main

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@lentzi90
Copy link
Member

lentzi90 commented Jan 8, 2024

/override test-ubuntu-integration-main

@metal3-io-bot
Copy link
Contributor

@lentzi90: Overrode contexts on behalf of lentzi90: test-ubuntu-integration-main

In response to this:

/override test-ubuntu-integration-main

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@metal3-io-bot metal3-io-bot merged commit 42b44d7 into metal3-io:main Jan 8, 2024
15 checks passed
@metal3-io-bot metal3-io-bot deleted the tuomo/reduce-dependabot-rights branch January 8, 2024 13:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@kashifest kashifest kashifest left review comments

@lentzi90 lentzi90 lentzi90 left review comments

Assignees
No one assigned
Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. lgtm Indicates that a PR is ready to be merged. size/L Denotes a PR that changes 100-499 lines, ignoring generated files.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@tuminoid @metal3-io-bot @lentzi90 @kashifest