Follow GHA Best Practices

Author: rwinch

.github/workflows/build-and-deploy.yml

@@ -1,5 +1,5 @@
 name: Build and Deploy
-
+permissions: read-all
 on:
   push:
     branches: [ main ]

.github/workflows/build.yml

@@ -1,5 +1,5 @@
 name: Build
-
+permissions: read-all
 on:
   workflow_call:
     inputs:

.github/workflows/deploy-artifacts.yml

@@ -1,5 +1,5 @@
 name: Deploy Artifacts
-
+permissions: read-all
 on:
   workflow_call:
     inputs:

.github/workflows/dispatch-deploy-docs.yml

@@ -30,7 +30,8 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           BRANCH_NAME: ${{ inputs.branch-name }}
-        run: gh workflow run deploy-docs.yml -r "$BRANCH_NAME" -f build-refname=${{ github.ref_name }}
+          REF_NAME: ${{ github.ref_name }}
+        run: gh workflow run deploy-docs.yml -r "$BRANCH_NAME" -f build-refname="$REF_NAME"
       - name: Dispatch (full build)
         if: ${{ inputs.build-type == 'full' }}
         env:

.github/workflows/perform-release.yml

@@ -127,31 +127,31 @@ jobs:
           ANNOUNCING_ID: ${{ inputs.slack-announcing-id }}
           WEBHOOK_URL: ${{ secrets.SPRING_RELEASE_GCHAT_WEBHOOK_URL }}
         run: |
-          curl -X POST '${{ env.WEBHOOK_URL }}' -H 'Content-Type: application/json' -d '{ "text": "${{ env.ANNOUNCING_ID }} `${{ env.VERSION }}` is available now" }' || true
+          curl -X POST "${WEBHOOK_URL}" -H 'Content-Type: application/json' -d "{ \"text\": \"${ANNOUNCING_ID}\" `${VERSION}` is available now\" }" || true
       - name: Delete Previous Version
         if: ${{ steps.previous-release-milestone.outputs.version != '' }}
         env:
           VERSION: ${{ steps.previous-release-milestone.outputs.version }}
-        run: ./gradlew deleteSaganRelease -PpreviousVersion=$VERSION -PgitHubAccessToken=$TOKEN
+        run: ./gradlew deleteSaganRelease -PpreviousVersion="$VERSION" -PgitHubAccessToken="$TOKEN"
       - name: Create Released Version
         env:
           VERSION: ${{ steps.project-version.outputs.version }}
-        run: ./gradlew createSaganRelease -PnextVersion=$VERSION -PgitHubAccessToken=$TOKEN
+        run: ./gradlew createSaganRelease -PnextVersion="$VERSION" -PgitHubAccessToken="$TOKEN"
       - name: Close Release Milestone
         env:
           VERSION: ${{ steps.project-version.outputs.version }}
-        run: ./gradlew closeMilestone -PnextVersion=$VERSION -PgitHubAccessToken=$TOKEN
+        run: ./gradlew closeMilestone -PnextVersion="$VERSION" -PgitHubAccessToken="$TOKEN"
       - name: Delete Previous Snapshot Version
         if: ${{ steps.previous-snapshot-version.outputs.version != '' }}
         env:
           VERSION: ${{ steps.previous-snapshot-version.outputs.version }}
-        run: ./gradlew deleteSaganRelease -PpreviousVersion=$VERSION -PgitHubAccessToken=$TOKEN
+        run: ./gradlew deleteSaganRelease -PpreviousVersion="$VERSION" -PgitHubAccessToken="$TOKEN"
       - name: Create Next Snapshot Version
         env:
           VERSION: ${{ steps.next-snapshot-version.outputs.version }}
-        run: ./gradlew createSaganRelease -PnextVersion=$VERSION -PgitHubAccessToken=$TOKEN
+        run: ./gradlew createSaganRelease -PnextVersion="$VERSION" -PgitHubAccessToken="$TOKEN"
       - name: Schedule Next Release (if not already scheduled)
         if: ${{ steps.has-oss-support.outputs.result == 'true' }}
         env:
           VERSION: ${{ steps.next-release-milestone.outputs.version }}
-        run: ./gradlew scheduleNextRelease -PnextVersion=$VERSION -PgitHubAccessToken=$TOKEN
+        run: ./gradlew scheduleNextRelease -PnextVersion="$VERSION" -PgitHubAccessToken="$TOKEN"

.github/workflows/publish-plugins.yml

@@ -1,5 +1,5 @@
 name: Publish Plugins
-
+permissions: read-all
 on:
   workflow_call:
     inputs:

.github/workflows/retrieve-spring-supported-versions.yml

@@ -30,20 +30,25 @@ jobs:
     runs-on: ubuntu-latest
     outputs:
       supported_versions: ${{ steps.get-supported-versions.outputs.supported_versions }}
+    env:
+      PROJECT: ${{ inputs.project }}
+      REPOSITORY_NAME: ${{ inputs.repository_name }}
+      TYPE: ${{ inputs.type }}
+
     steps:
       - id: get-supported-versions
         shell: bash
         run: |
-          if [ "${{ inputs.type }}" = "commercial" ]; then
-            response=$(curl https://api.spring.io/projects/${{ inputs.project }}/generations | jq --arg current "$(date +%F)" -c '.["_embedded"]["generations"] | map(select((.commercialSupportEndDate + "T00:00:00") > $current and (.ossSupportEndDate + "T00:00:00") < $current)) | sort_by(.initialReleaseDate) | .[].name' -r ${{ inputs.additional_curl_args }})
+          if [ "$TYPE" = "commercial" ]; then
+            response=$(curl "https://api.spring.io/projects/$PROJECT/generations" | jq --arg current "$(date +%F)" -c '.["_embedded"]["generations"] | map(select((.commercialSupportEndDate + "T00:00:00") > $current and (.ossSupportEndDate + "T00:00:00") < $current)) | sort_by(.initialReleaseDate) | .[].name' -r ${{ inputs.additional_curl_args }})
           else
-            response=$(curl -s https://api.spring.io/projects/${{ inputs.project }}/generations | jq --arg current "$(date +%F)" -c '.["_embedded"]["generations"] | map(select((.ossSupportEndDate + "T00:00:00") > $current)) | sort_by(.initialReleaseDate) | .[].name' -r ${{ inputs.additional_curl_args }})
+            response=$(curl -s "https://api.spring.io/projects/$PROJECT/generations" | jq --arg current "$(date +%F)" -c '.["_embedded"]["generations"] | map(select((.ossSupportEndDate + "T00:00:00") > $current)) | sort_by(.initialReleaseDate) | .[].name' -r ${{ inputs.additional_curl_args }})
           fi
           
           versions=""
           
           for version in $(echo "$response" | tr '\n' ' '); do
-            status_code=$(curl -s -o /dev/null -w "%{http_code}" "https://github.com/${{ inputs.repository_name }}/tree/$version")
+            status_code=$(curl -s -o /dev/null -w "%{http_code}" "https://github.com/$REPOSITORY_NAME/tree/$version")
             if [ "$status_code" -eq 200 ]; then
               if [ -z "$versions" ]; then
                 versions="$version"

.github/workflows/test.yml

@@ -1,5 +1,5 @@
 name: Test
-
+permissions: read-all
 on:
   workflow_call:
     inputs: