Skip to content

Commit 81337c6

Browse files
committed
ci: assigner: harden workflow
Various improvements: - pin actions and pip packages - set permissions - use gh token instead of custom token. Signed-off-by: Anas Nashif <[email protected]>
1 parent d4b62d4 commit 81337c6

File tree

1 file changed

+19
-7
lines changed

1 file changed

+19
-7
lines changed

.github/workflows/assigner.yml

Lines changed: 19 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -15,24 +15,36 @@ on:
1515
types:
1616
- labeled
1717

18+
permissions:
19+
contents: read
20+
1821
jobs:
1922
assignment:
2023
name: Pull Request Assignment
2124
if: github.event.pull_request.draft == false
2225
runs-on: ubuntu-22.04
26+
permissions:
27+
pull-requests: write # to add assignees to pull requests
28+
issues: write # to add assignees to issues
2329

2430
steps:
25-
- name: Install Python dependencies
26-
run: |
27-
sudo pip3 install -U setuptools wheel pip
28-
pip3 install -U PyGithub>=1.55 west
29-
3031
- name: Check out source code
31-
uses: actions/checkout@v4
32+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
33+
34+
- name: Set up Python
35+
uses: actions/setup-python@8d9ed9ac5c53483de85588cdf95a591a75ab9f55 # v5.5.0
36+
with:
37+
python-version: 3.12
38+
cache: pip
39+
cache-dependency-path: scripts/requirements-actions.txt
40+
41+
- name: Install Python packages
42+
run: |
43+
pip install -r scripts/requirements-actions.txt --require-hashes
3244
3345
- name: Run assignment script
3446
env:
35-
GITHUB_TOKEN: ${{ secrets.ZB_GITHUB_TOKEN }}
47+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
3648
run: |
3749
FLAGS="-v"
3850
FLAGS+=" -o ${{ github.event.repository.owner.login }}"

0 commit comments

Comments
 (0)