Unverified Commit b381a831 authored by Wolfgang Walther's avatar Wolfgang Walther Committed by GitHub
Browse files

workflows: make requested permissions explicit for create-github-app-token (#398180)

parents 98ed531d 40528439

.github/workflows/backport.yml

+2 −0
Original line number Diff line number Diff line
@@ -24,6 +24,8 @@ jobs: 
        with:

          app-id: ${{ vars.NIXPKGS_CI_APP_ID }}

          private-key: ${{ secrets.NIXPKGS_CI_APP_PRIVATE_KEY }}

          permission-contents: write

          permission-pull-requests: write



      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

        with:

.github/workflows/codeowners-v2.yml

+5 −0
Original line number Diff line number Diff line
@@ -68,6 +68,8 @@ jobs: 
        with:

          app-id: ${{ vars.OWNER_RO_APP_ID }}

          private-key: ${{ secrets.OWNER_RO_APP_PRIVATE_KEY }}

          permission-administration: read

          permission-members: read



      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

        with:
@@ -101,6 +103,9 @@ jobs: 
        with:

          app-id: ${{ vars.OWNER_APP_ID }}

          private-key: ${{ secrets.OWNER_APP_PRIVATE_KEY }}

          permission-administration: read

          permission-members: read

          permission-pull-requests: write



      - name: Build review request package

        run: nix-build ci -A requestReviews

.github/workflows/eval.yml

+3 −0
Original line number Diff line number Diff line
@@ -249,6 +249,9 @@ jobs: 
        with:

          app-id: ${{ vars.OWNER_APP_ID }}

          private-key: ${{ secrets.OWNER_APP_PRIVATE_KEY }}

          permission-administration: read

          permission-members: read

          permission-pull-requests: write



      - name: Download process result

        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8

.github/workflows/periodic-merge.yml

+2 −0
Original line number Diff line number Diff line
@@ -24,6 +24,8 @@ jobs: 
        with:

          app-id: ${{ vars.NIXPKGS_CI_APP_ID }}

          private-key: ${{ secrets.NIXPKGS_CI_APP_PRIVATE_KEY }}

          permission-contents: write

          permission-pull-requests: write



      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2