pFad - Phone/Frame/Anonymizer/Declutterfier! Saves Data!


--- a PPN by Garber Painting Akron. With Image Size Reduction included!

URL: http://github.com/matplotlib/matplotlib/commit/feec9c5f1dc7869a4ec6fb09c6203f6ccff64573

da.css" /> Add explicit permissions to GitHub Actions · matplotlib/matplotlib@feec9c5 · GitHub
Skip to content

Commit feec9c5

Browse files
QuLogicQuLogic
committed
Add explicit permissions to GitHub Actions
Also update the CircleCI check to the action's latest recommended jobs.
1 parent 116ace5 commit feec9c5

File tree

10 files changed

+46
-2
lines changed

10 files changed

+46
-2
lines changed

‎.circleci/config.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -229,4 +229,6 @@ workflows:
229229
version: 2
230230
build:
231231
jobs:
232+
# NOTE: If you rename this job, then you must update the `if` condition
233+
# and `circleci-jobs` option in `.github/workflows/circleci.yml`.
232234
- docs-python38

‎.github/workflows/cibuildsdist.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
---
12
name: Build CI sdist and wheel
23

34
on:
@@ -17,6 +18,9 @@ on:
1718
- reopened
1819
- labeled
1920

21+
permissions:
22+
contents: read
23+
2024
jobs:
2125
build_sdist:
2226
if: |

‎.github/workflows/cibuildwheel.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
---
12
name: Build CI wheels
23

34
on:
@@ -17,6 +18,9 @@ on:
1718
- reopened
1819
- labeled
1920

21+
permissions:
22+
contents: read
23+
2024
jobs:
2125
build_wheels:
2226
if: |

‎.github/workflows/circleci.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,11 @@
1+
---
12
on: [status]
3+
permissions:
4+
statuses: write
25
jobs:
36
circleci_artifacts_redirector_job:
47
runs-on: ubuntu-latest
8+
if: "${{ github.event.context == 'ci/circleci: docs-python38' }}"
59
name: Run CircleCI artifacts redirector
610
steps:
711
- name: GitHub Action step
@@ -11,3 +15,7 @@ jobs:
1115
artifact-path: 0/doc/build/html/index.html
1216
circleci-jobs: docs-python38
1317
job-title: View the built docs
18+
- name: Check the URL
19+
if: github.event.status != 'pending'
20+
run: |
21+
curl --fail ${{ steps.step1.outputs.url }} | grep $GITHUB_SHA

‎.github/workflows/clean_pr.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,10 @@
1+
---
12
name: PR cleanliness
23
on: [pull_request]
34

5+
permissions:
6+
contents: read
7+
48
jobs:
59
pr_clean:
610
runs-on: ubuntu-latest

‎.github/workflows/conflictcheck.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
---
12
name: "Maintenance"
23
on:
34
# So that PRs touching the same files as the push are updated
@@ -8,6 +9,9 @@ on:
89
pull_request_target:
910
types: [synchronize]
1011

12+
permissions:
13+
pull-requests: write
14+
1115
jobs:
1216
main:
1317
runs-on: ubuntu-latest

‎.github/workflows/nightlies.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,9 @@ on:
77
# Run on demand with workflow dispatch
88
workflow_dispatch:
99

10+
permissions:
11+
actions: read
12+
1013
jobs:
1114
upload_nightly_wheels:
1215
name: Upload nightly wheels to Anaconda Cloud

‎.github/workflows/pr_welcome.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,11 @@
1+
---
12
name: PR Greetings
23

34
on: [pull_request_target]
45

6+
permissions:
7+
pull-requests: write
8+
59
jobs:
610
greeting:
711
runs-on: ubuntu-latest

‎.github/workflows/reviewdog.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,12 @@
1+
---
12
name: Linting
23
on: [pull_request]
34

5+
permissions:
6+
contents: read
7+
checks: write
8+
pull-requests: write
9+
410
jobs:
511
flake8:
612
name: flake8

‎.github/workflows/tests.yml‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
---
12
name: Tests
23
concurrency:
34
group: ${{ github.workflow }}-${{ github.event.number }}-${{ github.event.ref }}
@@ -25,6 +26,8 @@ env:
2526
jobs:
2627
test:
2728
if: "github.event_name == 'workflow_dispatch' || github.repository == 'matplotlib/matplotlib' && !contains(github.event.head_commit.message, '[ci skip]') && !contains(github.event.head_commit.message, '[skip ci]') && !contains(github.event.head_commit.message, '[skip github]')"
29+
permissions:
30+
contents: read
2831
name: "Python ${{ matrix.python-version }} on ${{ matrix.os }} ${{ matrix.name-suffix }}"
2932
runs-on: ${{ matrix.os }}
3033

@@ -285,9 +288,11 @@ jobs:
285288

286289
# Separate dependent job to only upload one issue from the matrix of jobs
287290
create-issue:
288-
runs-on: ubuntu-latest
289-
needs: [test]
290291
if: ${{ failure() && github.event_name == 'schedule' }}
292+
needs: [test]
293+
permissions:
294+
issues: write
295+
runs-on: ubuntu-latest
291296
name: "Create issue on failure"
292297

293298
steps:

0 commit comments

Comments
 (0)
pFad - Phonifier reborn

Pfad - The Proxy pFad © 2024 Your Company Name. All rights reserved.




Check this box to remove all script contents from the fetched content.



Check this box to remove all images from the fetched content.


Check this box to remove all CSS styles from the fetched content.


Check this box to keep images inefficiently compressed and original size.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy