wip

Author: hmottestad

.github/workflows/pr-verify.yml

@@ -2,6 +2,10 @@ name: PR verify
 
 on: pull_request
 
+permissions:
+  contents: read          # checkout & other read‑only operations
+  actions: write          # allows the cancel‑workflow step to call the Actions API
+
 jobs:
 
   formatting:
@@ -27,7 +31,7 @@ jobs:
         with:
           repo: eclipse/rdf4j
           workflow_id: ${{ github.run_id }}
-          access_token: ${{secrets.GITHUB_TOKEN}}
+          access_token: ${{ github.token }}
 
   compile:
     runs-on: ubuntu-latest
@@ -52,7 +56,7 @@ jobs:
         with:
           repo: eclipse/rdf4j
           workflow_id: ${{ github.run_id }}
-          access_token: ${{secrets.GITHUB_TOKEN}}
+          access_token: ${{ github.token }}
 
   build:
     runs-on: ubuntu-latest
@@ -80,7 +84,7 @@ jobs:
         run: mvn -B test -DskipITs -P-formatting -Dmaven.javadoc.skip -Djapicmp.skip -Denforcer.skip -Danimal.sniffer.skip
       - name: Publish Test Report
         if: failure()
-        uses: scacap/action-surefire-report@v1
+        uses: scacap/action-surefire-report@v1.9.0
         with:
           check_name: Test report - build - ${{ matrix.jdk }}
       - name: Cancel workflow on failure
@@ -89,7 +93,7 @@ jobs:
         with:
           repo: eclipse/rdf4j
           workflow_id: ${{ github.run_id }}
-          access_token: ${{secrets.GITHUB_TOKEN}}
+          access_token: ${{ github.token }}
 
   integration-tests:
     runs-on: ubuntu-latest
@@ -114,7 +118,7 @@ jobs:
         run: mvn -B verify -PskipUnitTests,-formatting -Dmaven.javadoc.skip -Denforcer.skip -Danimal.sniffer.skip
       - name: Publish Test Report
         if: failure()
-        uses: scacap/action-surefire-report@v1
+        uses: scacap/action-surefire-report@v1.9.0
         with:
           check_name: Test report - integration-tests
 
@@ -141,7 +145,7 @@ jobs:
         run: mvn -B verify -PslowTestsOnly,-skipSlowTests,-formatting -Dmaven.javadoc.skip -Djapicmp.skip -Denforcer.skip -Danimal.sniffer.skip
       - name: Publish Test Report
         if: failure()
-        uses: scacap/action-surefire-report@v1
+        uses: scacap/action-surefire-report@v1.9.0
         with:
           check_name: Test report - slow-tests
 
@@ -170,7 +174,7 @@ jobs:
         with:
           repo: eclipse/rdf4j
           workflow_id: ${{ github.run_id }}
-          access_token: ${{secrets.GITHUB_TOKEN}}
+          access_token: ${{ github.token }}
 
   e2e:
     runs-on: ubuntu-latest
@@ -209,5 +213,4 @@ jobs:
         with:
           repo: eclipse/rdf4j
           workflow_id: ${{ github.run_id }}
-          access_token: ${{secrets.GITHUB_TOKEN}}
-
+          access_token: ${{ github.token }}