Skip to content

ci: add GitHub token permissions for workflows #47652

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Jul 11, 2022
Merged

ci: add GitHub token permissions for workflows #47652

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
e94e1ef
ci: add GitHub token permissions for workflows
varunsh-coder Jul 9, 2022
7461eb4
trim trailing whitespace
varunsh-coder Jul 9, 2022
4fa5352
Update stale-pr.yml
varunsh-coder Jul 10, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions .github/workflows/32-bit-linux.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,9 @@ on:
paths-ignore:
- "doc/**"

permissions:
contents: read

jobs:
pytest:
runs-on: ubuntu-latest
Expand Down
6 changes: 6 additions & 0 deletions .github/workflows/assign.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,8 +3,14 @@ on:
issue_comment:
types: created

permissions:
contents: read

jobs:
issue_assign:
permissions:
issues: write
pull-requests: write
runs-on: ubuntu-latest
steps:
- if: github.event.comment.body == 'take'
Expand Down
7 changes: 7 additions & 0 deletions .github/workflows/asv-bot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,8 +9,15 @@ env:
ENV_FILE: environment.yml
COMMENT: ${{github.event.comment.body}}

permissions:
contents: read

jobs:
autotune:
permissions:
contents: read
issues: write
pull-requests: write
name: "Run benchmarks"
# TODO: Support more benchmarking options later, against different branches, against self, etc
if: startsWith(github.event.comment.body, '@github-actions benchmark')
Expand Down
6 changes: 6 additions & 0 deletions .github/workflows/autoupdate-pre-commit-config.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,8 +5,14 @@ on:
- cron: "0 7 1 * *" # At 07:00 on 1st of every month.
workflow_dispatch:

permissions:
contents: read

jobs:
update-pre-commit:
permissions:
contents: write # for technote-space/create-pr-action to push code
pull-requests: write # for technote-space/create-pr-action to create a PR
if: github.repository_owner == 'pandas-dev'
name: Autoupdate pre-commit config
runs-on: ubuntu-latest
Expand Down
3 changes: 3 additions & 0 deletions .github/workflows/code-checks.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,9 @@ env:
ENV_FILE: environment.yml
PANDAS_CI: 1

permissions:
contents: read

jobs:
pre_commit:
name: pre-commit
Expand Down
3 changes: 3 additions & 0 deletions .github/workflows/docbuild-and-upload.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,9 @@ env:
ENV_FILE: environment.yml
PANDAS_CI: 1

permissions:
contents: read

jobs:
web_and_docs:
name: Doc Build and Upload
Expand Down
3 changes: 3 additions & 0 deletions .github/workflows/macos-windows.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,9 @@ env:
PATTERN: "not slow and not db and not network and not single_cpu"


permissions:
contents: read

jobs:
pytest:
defaults:
Expand Down
3 changes: 3 additions & 0 deletions .github/workflows/python-dev.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,9 @@ env:
COVERAGE: true
PYTEST_TARGET: pandas

permissions:
contents: read

jobs:
build:
if: false # Comment this line out to "unfreeze"
Expand Down
3 changes: 3 additions & 0 deletions .github/workflows/sdist.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,9 @@ on:
paths-ignore:
- "doc/**"

permissions:
contents: read

jobs:
build:
if: ${{ github.event.label.name == 'Build' || contains(github.event.pull_request.labels.*.name, 'Build') || github.event_name == 'push'}}
Expand Down
6 changes: 6 additions & 0 deletions .github/workflows/stale-pr.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,8 +4,14 @@ on:
# * is a special character in YAML so you have to quote this string
- cron: "0 0 * * *"

permissions:
contents: read

jobs:
stale:
permissions:
issues: write # for actions/stale to close stale issues
Copy link
Member

@phofl phofl Jul 10, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We are not closing the prs, the not only adds a label stale

Copy link
Contributor Author

@varunsh-coder varunsh-coder Jul 10, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi @phofl, is your ask to remove or change the comment? Just wanted to confirm before making the change.

I can remove the comment or change it to to label stale PRs.

Also, looks like this workflow does not update stale issues. If that is the case, I can remove the issues: write permission.

Copy link
Member

@mroeschke mroeschke Jul 10, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This action only adds a stale label and writes one comment to a PR, so whatever permission are needed to perform those actions can be set.

Copy link
Contributor Author

@varunsh-coder varunsh-coder Jul 10, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Updated stale-pr.yml. Removed issues: write since issues are not being updated based on the config. Also removed the comment for pull-requests: write.

pull-requests: write # for actions/stale to close stale PRs
runs-on: ubuntu-latest
steps:
- uses: actions/stale@v4
Expand Down
3 changes: 3 additions & 0 deletions .github/workflows/ubuntu.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,9 @@ on:
env:
PANDAS_CI: 1

permissions:
contents: read

jobs:
pytest:
runs-on: ubuntu-latest
Expand Down