ci: set minimal permissions to github workflows (#4665)

* set ci.yml minimal permissions

Signed-off-by: Joyce <joycebrum@google.com>

* set configure.yml minimal permissions

Signed-off-by: Joyce <joycebrum@google.com>

* set format.yml minimal permissions

Signed-off-by: Joyce <joycebrum@google.com>

* set pip.yml minimal permissions

Signed-off-by: Joyce <joycebrum@google.com>

* set upstream.yml minimal permissions

Signed-off-by: Joyce <joycebrum@google.com>

* set labeler.yml minimal permissions

Signed-off-by: Joyce <joycebrum@google.com>

* Update ci.yml to read all

Signed-off-by: Joyce <joycebrum@google.com>

* test labeler.yml

Signed-off-by: Joyce <joycebrum@google.com>

* restore the if at labeler.yml

Signed-off-by: Joyce <joycebrum@google.com>

---------

Signed-off-by: Joyce <joycebrum@google.com>
This commit is contained in:
Joyce 2023-05-15 14:02:25 -03:00 committed by GitHub
parent cca4c51ca4
commit d72ffb448c
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
6 changed files with 19 additions and 0 deletions

View File

@ -9,6 +9,8 @@ on:
- stable
- v*
permissions: read-all
concurrency:
group: test-${{ github.ref }}
cancel-in-progress: true

View File

@ -9,6 +9,9 @@ on:
- stable
- v*
permissions:
contents: read
env:
# For cmake:
VERBOSE: 1

View File

@ -12,6 +12,9 @@ on:
- stable
- "v*"
permissions:
contents: read
env:
FORCE_COLOR: 3
# For cmake:

View File

@ -3,10 +3,15 @@ on:
pull_request_target:
types: [closed]
permissions: {}
jobs:
label:
name: Labeler
runs-on: ubuntu-latest
permissions:
contents: read
pull-requests: write
steps:
- uses: actions/labeler@main

View File

@ -12,6 +12,9 @@ on:
types:
- published
permissions:
contents: read
env:
PIP_ONLY_BINARY: numpy

View File

@ -5,6 +5,9 @@ on:
workflow_dispatch:
pull_request:
permissions:
contents: read
concurrency:
group: upstream-${{ github.ref }}
cancel-in-progress: true