Remove GHA permissions where possible (#4812)

This commit is contained in:
Max Howell 2024-01-11 15:05:04 -05:00 committed by GitHub
parent 53548a46b8
commit 3ad1bb655a
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 5 additions and 1 deletions

View file

@ -5,7 +5,7 @@ on:
pull_request: pull_request:
paths: paths:
- .github/workflows/pkg.yml - .github/workflows/pkg.yml
- .github/workflows/pkg-for-platform.yml - .github/workflows/pkg-platform.yml
- .github/workflows/ci-squared.yml - .github/workflows/ci-squared.yml
concurrency: concurrency:

View file

@ -59,6 +59,7 @@ jobs:
name: build ${{inputs.tinyname}} name: build ${{inputs.tinyname}}
runs-on: ${{ fromJSON(inputs.os) }} runs-on: ${{ fromJSON(inputs.os) }}
container: ${{ inputs.container }} container: ${{ inputs.container }}
permissions: {}
outputs: outputs:
project: ${{ steps.build.outputs.project }} project: ${{ steps.build.outputs.project }}
version: ${{ steps.build.outputs.version }} version: ${{ steps.build.outputs.version }}
@ -100,6 +101,7 @@ jobs:
matrix: matrix:
os: ${{ fromJSON(inputs.test-os) }} os: ${{ fromJSON(inputs.test-os) }}
container: ${{ fromJSON(inputs.test-container) }} container: ${{ fromJSON(inputs.test-container) }}
permissions: {}
runs-on: ${{ matrix.os }} runs-on: ${{ matrix.os }}
container: ${{ matrix.container }} container: ${{ matrix.container }}
env: env:
@ -117,6 +119,7 @@ jobs:
bottle: bottle:
name: bottle (${{inputs.tinyname}}.${{matrix.compression}}) name: bottle (${{inputs.tinyname}}.${{matrix.compression}})
needs: [build, test] needs: [build, test]
permissions: {}
strategy: strategy:
matrix: matrix:
compression: [xz, gz] compression: [xz, gz]
@ -188,6 +191,7 @@ jobs:
name: publish ${{inputs.tinyname}} ${{ inputs.dry-run && '(dry-run)' }} name: publish ${{inputs.tinyname}} ${{ inputs.dry-run && '(dry-run)' }}
runs-on: ubuntu-latest runs-on: ubuntu-latest
needs: [bottle, build] needs: [bottle, build]
permissions: {}
env: env:
DIRNAME: ${{ needs.build.outputs.project }}/${{ needs.build.outputs.platform }}/${{ needs.build.outputs.arch }} DIRNAME: ${{ needs.build.outputs.project }}/${{ needs.build.outputs.platform }}/${{ needs.build.outputs.arch }}
steps: steps: