Xqt has submitted this change. (
https://gerrit.wikimedia.org/r/c/pywikibot/core/+/1295537?usp=email )
Change subject: tests: restrict all workflow permissions to `contents: read`
......................................................................
tests: restrict all workflow permissions to `contents: read`
This increases the security level of GitHub Actions runners.
Change-Id: Iac7034307adc9a8ee472bab17ddc2ea25e11c7cd
---
M .github/workflows/doctest.yml
M .github/workflows/graalpy_tests.yml
M .github/workflows/login_tests-ci.yml
M .github/workflows/oauth_tests-ci.yml
M .github/workflows/pre-commit.yml
M .github/workflows/pywikibot-ci.yml
M .github/workflows/sysop_write_tests-ci.yml
M .github/workflows/windows_tests.yml
8 files changed, 25 insertions(+), 3 deletions(-)
Approvals:
jenkins-bot: Verified
Xqt: Looks good to me, approved
diff --git a/.github/workflows/doctest.yml b/.github/workflows/doctest.yml
index 0c65ec1..99051d7 100644
--- a/.github/workflows/doctest.yml
+++ b/.github/workflows/doctest.yml
@@ -10,14 +10,15 @@
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
+permissions:
+ contents: read
+
env:
PYWIKIBOT_TEST_RUNNING: 1
PYWIKIBOT_USERNAME: Pywikibot-test
jobs:
build:
- permissions:
- contents: read
runs-on: ${{ matrix.os || 'ubuntu-latest' }}
timeout-minutes: 10
strategy:
diff --git a/.github/workflows/graalpy_tests.yml
b/.github/workflows/graalpy_tests.yml
index 0415b54..87f464b 100644
--- a/.github/workflows/graalpy_tests.yml
+++ b/.github/workflows/graalpy_tests.yml
@@ -10,6 +10,9 @@
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
+permissions:
+ contents: read
+
env:
PYWIKIBOT_TEST_RUNNING: 1
PYWIKIBOT_USERNAME: Pywikibot-test
diff --git a/.github/workflows/login_tests-ci.yml
b/.github/workflows/login_tests-ci.yml
index a39a5cc..0c13664 100644
--- a/.github/workflows/login_tests-ci.yml
+++ b/.github/workflows/login_tests-ci.yml
@@ -8,6 +8,9 @@
branches: [master]
types: [completed]
+permissions:
+ contents: read
+
env:
PYWIKIBOT_TEST_RUNNING: 1
PYWIKIBOT_TEST_LOGOUT: 1
diff --git a/.github/workflows/oauth_tests-ci.yml
b/.github/workflows/oauth_tests-ci.yml
index c82c657..9935398 100644
--- a/.github/workflows/oauth_tests-ci.yml
+++ b/.github/workflows/oauth_tests-ci.yml
@@ -10,6 +10,9 @@
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
+permissions:
+ contents: read
+
env:
PYWIKIBOT_TEST_RUNNING: 1
PYWIKIBOT_USERNAME: Pywikibot-oauth
diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml
index 6bbf114..3ec3575 100644
--- a/.github/workflows/pre-commit.yml
+++ b/.github/workflows/pre-commit.yml
@@ -9,15 +9,18 @@
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
+permissions:
+ contents: read
+
env:
PYWIKIBOT_TEST_RUNNING: 1
PYWIKIBOT_NO_USER_CONFIG: 2
jobs:
pre-commit:
- timeout-minutes: 10
runs-on: ${{ matrix.os || 'ubuntu-latest' }}
continue-on-error: ${{ matrix.experimental || false }}
+ timeout-minutes: 10
strategy:
fail-fast: false
matrix:
diff --git a/.github/workflows/pywikibot-ci.yml
b/.github/workflows/pywikibot-ci.yml
index a37a5cc..986e3eb 100644
--- a/.github/workflows/pywikibot-ci.yml
+++ b/.github/workflows/pywikibot-ci.yml
@@ -12,6 +12,9 @@
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
+permissions:
+ contents: read
+
env:
PYWIKIBOT_TEST_RUNNING: 1
PYWIKIBOT_USERNAME: Pywikibot-test
diff --git a/.github/workflows/sysop_write_tests-ci.yml
b/.github/workflows/sysop_write_tests-ci.yml
index 0070fc8..b77f89b 100644
--- a/.github/workflows/sysop_write_tests-ci.yml
+++ b/.github/workflows/sysop_write_tests-ci.yml
@@ -10,6 +10,9 @@
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
+permissions:
+ contents: read
+
env:
PYWIKIBOT_TEST_RUNNING: 1
PYWIKIBOT_USERNAME: Pywikibot-test
diff --git a/.github/workflows/windows_tests.yml
b/.github/workflows/windows_tests.yml
index 24ef712..7243a8d 100644
--- a/.github/workflows/windows_tests.yml
+++ b/.github/workflows/windows_tests.yml
@@ -10,6 +10,9 @@
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
+permissions:
+ contents: read
+
env:
PYWIKIBOT_TEST_RUNNING: 1
PYWIKIBOT_USERNAME: Pywikibot-test
--
To view, visit
https://gerrit.wikimedia.org/r/c/pywikibot/core/+/1295537?usp=email
To unsubscribe, or for help writing mail filters, visit
https://gerrit.wikimedia.org/r/settings?usp=email
Gerrit-MessageType: merged
Gerrit-Project: pywikibot/core
Gerrit-Branch: master
Gerrit-Change-Id: Iac7034307adc9a8ee472bab17ddc2ea25e11c7cd
Gerrit-Change-Number: 1295537
Gerrit-PatchSet: 1
Gerrit-Owner: Xqt <[email protected]>
Gerrit-Reviewer: Xqt <[email protected]>
Gerrit-Reviewer: jenkins-bot
_______________________________________________
Pywikibot-commits mailing list -- [email protected]
To unsubscribe send an email to [email protected]
