mirror of https://github.com/pybind/pybind11.git
ci: set minimal permissions to github workflows (#4665)
* set ci.yml minimal permissions Signed-off-by: Joyce <joycebrum@google.com> * set configure.yml minimal permissions Signed-off-by: Joyce <joycebrum@google.com> * set format.yml minimal permissions Signed-off-by: Joyce <joycebrum@google.com> * set pip.yml minimal permissions Signed-off-by: Joyce <joycebrum@google.com> * set upstream.yml minimal permissions Signed-off-by: Joyce <joycebrum@google.com> * set labeler.yml minimal permissions Signed-off-by: Joyce <joycebrum@google.com> * Update ci.yml to read all Signed-off-by: Joyce <joycebrum@google.com> * test labeler.yml Signed-off-by: Joyce <joycebrum@google.com> * restore the if at labeler.yml Signed-off-by: Joyce <joycebrum@google.com> --------- Signed-off-by: Joyce <joycebrum@google.com>
This commit is contained in:
parent
cca4c51ca4
commit
d72ffb448c
|
@ -9,6 +9,8 @@ on:
|
|||
- stable
|
||||
- v*
|
||||
|
||||
permissions: read-all
|
||||
|
||||
concurrency:
|
||||
group: test-${{ github.ref }}
|
||||
cancel-in-progress: true
|
||||
|
|
|
@ -9,6 +9,9 @@ on:
|
|||
- stable
|
||||
- v*
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
env:
|
||||
# For cmake:
|
||||
VERBOSE: 1
|
||||
|
|
|
@ -12,6 +12,9 @@ on:
|
|||
- stable
|
||||
- "v*"
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
env:
|
||||
FORCE_COLOR: 3
|
||||
# For cmake:
|
||||
|
|
|
@ -3,10 +3,15 @@ on:
|
|||
pull_request_target:
|
||||
types: [closed]
|
||||
|
||||
permissions: {}
|
||||
|
||||
jobs:
|
||||
label:
|
||||
name: Labeler
|
||||
runs-on: ubuntu-latest
|
||||
permissions:
|
||||
contents: read
|
||||
pull-requests: write
|
||||
steps:
|
||||
|
||||
- uses: actions/labeler@main
|
||||
|
|
|
@ -12,6 +12,9 @@ on:
|
|||
types:
|
||||
- published
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
env:
|
||||
PIP_ONLY_BINARY: numpy
|
||||
|
||||
|
|
|
@ -5,6 +5,9 @@ on:
|
|||
workflow_dispatch:
|
||||
pull_request:
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
concurrency:
|
||||
group: upstream-${{ github.ref }}
|
||||
cancel-in-progress: true
|
||||
|
|
Loading…
Reference in New Issue