Skip to content

ci: pin actions workflow step hashes and use minimum permissions #125

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
zimeg merged 4 commits into from
May 23, 2025
Merged

ci: pin actions workflow step hashes and use minimum permissions #125

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
25c2a35
ci: pin actions workflow step hashes and use minimum permissions
zimeg May 22, 2025
614e6c6
test: remove contents permissions for checkout checks
zimeg May 22, 2025
59a49bd
test: remove all permissions from the health score check perhaps
zimeg May 22, 2025
1adddc4
ci: return expected permissions to the health score checks
zimeg May 22, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 16 additions & 7 deletions .github/workflows/deno.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,9 +2,11 @@ name: Deno Format, Lint and Unit Tests

on:
push:
branches: [ main ]
branches:
- main
pull_request:
branches: [ main ]
branches:
- main

jobs:
test:
Expand All @@ -14,19 +16,23 @@ jobs:
# we test on both most recent stable version of deno (v1.x) as well as
# the version of deno used by Run on Slack (as noted in https://api.slack.com/slackcli/metadata.json)
deno-version: [v1.x, v1.45.4]
permissions:
contents: read
steps:
- name: Setup repo
uses: actions/checkout@v4
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
persist-credentials: false
- name: Setup Deno
uses: denoland/setup-deno@v2
uses: denoland/setup-deno@e95548e56dfa95d4e1a28d6f422fafe75c4c26fb # v2.0.3
with:
deno-version: ${{ matrix.deno-version }}
- name: Run formatter, linter and tests
run: deno task test
- name: Generate CodeCov-friendly coverage report
run: deno task generate-lcov
- name: Upload coverage to CodeCov
uses: codecov/codecov-action@v5
uses: codecov/codecov-action@18283e04ce6e62d37312384ff67231eb8fd56d24 # v5.4.3
with:
file: ./lcov.info
token: ${{ secrets.CODECOV_TOKEN }}
Expand All @@ -35,12 +41,15 @@ jobs:
needs: test
permissions:
checks: write
contents: read
runs-on: ubuntu-latest
steps:
- name: Setup repo
uses: actions/checkout@v4
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
persist-credentials: false
Comment on lines 47 to +50
Copy link
Member Author

@zimeg zimeg May 22, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🤔 It's not so clear if permissions.checks:write somehow includes the contents:read scopes?

Copy link
Member Author

@zimeg zimeg May 22, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📚 https://github.com/actions/checkout?tab=readme-ov-file#recommended-permissions

🤖 https://github.com/slackapi/deno-slack-api/actions/runs/15179844434/job/42686910983#step:1:16

GITHUB_TOKEN Permissions
  Checks: write
  Metadata: read

Copy link
Member Author

@zimeg zimeg May 22, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🗣️ I was about to loose marbles but this was an expected finding: slackapi/slack-health-score#93

- name: Report health score
uses: slackapi/slack-health-score@v0
uses: slackapi/slack-health-score@d58a419f15cdaff97e9aa7f09f95772830ab66f7 # v0.1.1
with:
codecov_token: ${{ secrets.FILS_CODECOV_API_TOKEN }}
github_token: ${{ secrets.GITHUB_TOKEN }}
Expand Down
17 changes: 11 additions & 6 deletions .github/workflows/npm.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,26 +4,31 @@ name: NPM Build

on:
push:
branches: [ main ]
branches:
- main
pull_request:
branches: [ main ]
branches:
- main

jobs:
build:
runs-on: macos-latest

permissions:
contents: read
steps:
- name: Actions checkout
uses: actions/checkout@v4
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
persist-credentials: false

- name: Setup node
uses: actions/setup-node@v4
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
with:
node-version: latest
registry-url: https://registry.npmjs.org/

- name: Setup Deno
uses: denoland/setup-deno@v2
uses: denoland/setup-deno@e95548e56dfa95d4e1a28d6f422fafe75c4c26fb # v2.0.3
with:
deno-version: v1.x

Expand Down
10 changes: 6 additions & 4 deletions .github/workflows/publish.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,14 +3,16 @@ name: Publish
on:
push:
tags:
- '*'
- "*"

jobs:
publish:
runs-on: ubuntu-latest
permissions:
contents: read
id-token: write # The OIDC ID token is used for authentication with JSR.
id-token: write # The OIDC ID token is used for authentication with JSR.
steps:
- uses: actions/checkout@v4
- run: npx jsr publish
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
persist-credentials: false
- run: npx jsr publish
17 changes: 11 additions & 6 deletions .github/workflows/samples.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,9 +3,11 @@ name: Samples Integration Type-checking

on:
push:
branches: [main]
branches:
- main
pull_request:
branches: [main]
branches:
- main

jobs:
samples:
Expand All @@ -22,22 +24,25 @@ jobs:
# we test on both most recent stable version of deno (v1.x) as well as
# the version of deno used by Run on Slack (as noted in https://api.slack.com/slackcli/metadata.json)
deno-version: [v1.x, v1.45.4]

permissions:
contents: read
steps:
- name: Setup Deno ${{ matrix.deno-version }}
uses: denoland/setup-deno@v2
uses: denoland/setup-deno@e95548e56dfa95d4e1a28d6f422fafe75c4c26fb # v2.0.3
with:
deno-version: ${{ matrix.deno-version }}

- name: Checkout the api
uses: actions/checkout@v4
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
path: ./deno-slack-api
persist-credentials: false
- name: Checkout the ${{ matrix.sample }} sample
uses: actions/checkout@v4
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
repository: ${{ matrix.sample }}
path: ./sample
persist-credentials: false

- name: Set imports.deno-slack-api/ to ../deno-slack-api/src/ in import_map.json
run: >
Expand Down
Loading