Xqt has submitted this change. (
https://gerrit.wikimedia.org/r/c/pywikibot/core/+/1295533?usp=email )
Change subject: tests: set GitHub action persist-credentials to false
......................................................................
tests: set GitHub action persist-credentials to false
Also restrict the doctest workflow permissions to `contents: read`
for testing purposes.
This increases the security level of GitHub Actions runners.
Change-Id: Ie63a703b171efe566be3bd570611c4070fc3f25c
---
M .github/workflows/doctest.yml
M .github/workflows/graalpy_tests.yml
M .github/workflows/login_tests-ci.yml
M .github/workflows/oauth_tests-ci.yml
M .github/workflows/pre-commit.yml
M .github/workflows/pywikibot-ci.yml
M .github/workflows/sysop_write_tests-ci.yml
M .github/workflows/windows_tests.yml
8 files changed, 10 insertions(+), 0 deletions(-)
Approvals:
Xqt: Looks good to me, approved
jenkins-bot: Verified
diff --git a/.github/workflows/doctest.yml b/.github/workflows/doctest.yml
index 4e48263..0c65ec1 100644
--- a/.github/workflows/doctest.yml
+++ b/.github/workflows/doctest.yml
@@ -16,6 +16,8 @@
jobs:
build:
+ permissions:
+ contents: read
runs-on: ${{ matrix.os || 'ubuntu-latest' }}
timeout-minutes: 10
strategy:
@@ -35,6 +37,7 @@
uses: actions/checkout@v6
with:
submodules: true
+ persist-credentials: false
- name: Set up Python ${{ matrix.python-version }}
uses: actions/setup-python@v6
with:
diff --git a/.github/workflows/graalpy_tests.yml
b/.github/workflows/graalpy_tests.yml
index e0d0672..0415b54 100644
--- a/.github/workflows/graalpy_tests.yml
+++ b/.github/workflows/graalpy_tests.yml
@@ -31,6 +31,7 @@
uses: actions/checkout@v6
with:
submodules: true
+ persist-credentials: false
- name: Set up Python ${{ matrix.python-version }}
uses: actions/setup-python@v6
with:
diff --git a/.github/workflows/login_tests-ci.yml
b/.github/workflows/login_tests-ci.yml
index e15a828..a39a5cc 100644
--- a/.github/workflows/login_tests-ci.yml
+++ b/.github/workflows/login_tests-ci.yml
@@ -83,6 +83,7 @@
uses: actions/checkout@v6
with:
submodules: true
+ persist-credentials: false
- name: Set up Python ${{ matrix.python-version }}
uses: actions/setup-python@v6
with:
diff --git a/.github/workflows/oauth_tests-ci.yml
b/.github/workflows/oauth_tests-ci.yml
index 550c38a..c82c657 100644
--- a/.github/workflows/oauth_tests-ci.yml
+++ b/.github/workflows/oauth_tests-ci.yml
@@ -49,6 +49,7 @@
uses: actions/checkout@v6
with:
submodules: true
+ persist-credentials: false
- name: Set up Python ${{ matrix.python-version }}
uses: actions/setup-python@v6
with:
diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml
index 6235209..6bbf114 100644
--- a/.github/workflows/pre-commit.yml
+++ b/.github/workflows/pre-commit.yml
@@ -37,6 +37,7 @@
uses: actions/checkout@v6
with:
submodules: true
+ persist-credentials: false
- name: run pre-commit
uses: pre-commit/[email protected]
env:
diff --git a/.github/workflows/pywikibot-ci.yml
b/.github/workflows/pywikibot-ci.yml
index 0cdd09e..a37a5cc 100644
--- a/.github/workflows/pywikibot-ci.yml
+++ b/.github/workflows/pywikibot-ci.yml
@@ -76,6 +76,7 @@
uses: actions/checkout@v6
with:
submodules: true
+ persist-credentials: false
- name: Set up Python ${{ matrix.python-version }}
uses: actions/setup-python@v6
with:
diff --git a/.github/workflows/sysop_write_tests-ci.yml
b/.github/workflows/sysop_write_tests-ci.yml
index 609027e..0070fc8 100644
--- a/.github/workflows/sysop_write_tests-ci.yml
+++ b/.github/workflows/sysop_write_tests-ci.yml
@@ -30,6 +30,7 @@
uses: actions/checkout@v6
with:
submodules: true
+ persist-credentials: false
- name: Set up Python ${{ matrix.python-version }}
uses: actions/setup-python@v6
with:
diff --git a/.github/workflows/windows_tests.yml
b/.github/workflows/windows_tests.yml
index 8d5bef1..24ef712 100644
--- a/.github/workflows/windows_tests.yml
+++ b/.github/workflows/windows_tests.yml
@@ -30,6 +30,7 @@
uses: actions/checkout@v6
with:
submodules: true
+ persist-credentials: false
- name: Set up Python ${{ matrix.python-version }}
uses: actions/setup-python@v6
with:
--
To view, visit
https://gerrit.wikimedia.org/r/c/pywikibot/core/+/1295533?usp=email
To unsubscribe, or for help writing mail filters, visit
https://gerrit.wikimedia.org/r/settings?usp=email
Gerrit-MessageType: merged
Gerrit-Project: pywikibot/core
Gerrit-Branch: master
Gerrit-Change-Id: Ie63a703b171efe566be3bd570611c4070fc3f25c
Gerrit-Change-Number: 1295533
Gerrit-PatchSet: 3
Gerrit-Owner: Xqt <[email protected]>
Gerrit-Reviewer: Xqt <[email protected]>
Gerrit-Reviewer: jenkins-bot
_______________________________________________
Pywikibot-commits mailing list -- [email protected]
To unsubscribe send an email to [email protected]
