From 388c935e7ca1df4ac3775e2fff1d5d29dc8fe8c4 Mon Sep 17 00:00:00 2001 From: Stephen Morgan Date: Thu, 10 Apr 2025 16:07:40 +1200 Subject: [PATCH 1/3] ci: explicit permission in actions --- .github/workflows/ci.yml | 3 +++ .github/workflows/deploy-check.yml | 5 ++++- .github/workflows/install.yml | 3 +++ .github/workflows/mirror-image.yml | 3 +++ .github/workflows/mirror.yml | 3 +++ .github/workflows/pg-prove.yml | 3 +++ .github/workflows/publish-migra.yml | 9 ++++++--- .github/workflows/release-beta.yml | 3 +++ .github/workflows/release.yml | 4 ++++ .github/workflows/tag-npm.yml | 3 +++ 10 files changed, 35 insertions(+), 4 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index e7cf2b30bc..02fc04898c 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -6,6 +6,9 @@ on: branches: - develop +permissions: + contents: read + jobs: test: name: Test diff --git a/.github/workflows/deploy-check.yml b/.github/workflows/deploy-check.yml index 44c2806ec5..3715958a00 100644 --- a/.github/workflows/deploy-check.yml +++ b/.github/workflows/deploy-check.yml @@ -1,7 +1,7 @@ name: Check Deploy on: - pull_request_target: + pull_request: types: - opened - reopened @@ -10,6 +10,9 @@ on: branches: - main +permissions: + contents: read + jobs: check: if: github.head_ref != 'develop' diff --git a/.github/workflows/install.yml b/.github/workflows/install.yml index e9bcd30b10..85640211bd 100644 --- a/.github/workflows/install.yml +++ b/.github/workflows/install.yml @@ -14,6 +14,9 @@ on: - 'package.json' - 'scripts/**' +permissions: + contents: write + jobs: pack: runs-on: ubuntu-latest diff --git a/.github/workflows/mirror-image.yml b/.github/workflows/mirror-image.yml index fb0bfd5db2..09365f5e04 100644 --- a/.github/workflows/mirror-image.yml +++ b/.github/workflows/mirror-image.yml @@ -13,6 +13,9 @@ on: required: true type: string +permissions: + contents: read + jobs: mirror: runs-on: ubuntu-latest diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index 0eb46d8684..126949ac0d 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -19,6 +19,9 @@ on: - submitted workflow_dispatch: +permissions: + contents: read + jobs: setup: runs-on: ubuntu-latest diff --git a/.github/workflows/pg-prove.yml b/.github/workflows/pg-prove.yml index 9844d7e614..052ac65832 100644 --- a/.github/workflows/pg-prove.yml +++ b/.github/workflows/pg-prove.yml @@ -3,6 +3,9 @@ name: Publish pg_prove on: workflow_dispatch: +permissions: + contents: read + jobs: settings: runs-on: ubuntu-latest diff --git a/.github/workflows/publish-migra.yml b/.github/workflows/publish-migra.yml index e3db68cb64..b4a2625c54 100644 --- a/.github/workflows/publish-migra.yml +++ b/.github/workflows/publish-migra.yml @@ -3,6 +3,9 @@ name: Publish migra on: workflow_dispatch: +permissions: + contents: read + jobs: settings: runs-on: ubuntu-latest @@ -70,9 +73,9 @@ jobs: password: ${{ secrets.DOCKER_PASSWORD }} - name: Merge multi-arch manifests run: | - docker buildx imagetools create -t ${{ needs.settings.outputs.image_tag }} \ - ${{ needs.settings.outputs.image_tag }}_amd64 \ - ${{ needs.settings.outputs.image_tag }}_arm64 + docker buildx imagetools create -t "${{ needs.settings.outputs.image_tag }}" \ + "${{ needs.settings.outputs.image_tag }}_amd64" \ + "${{ needs.settings.outputs.image_tag }}_arm64" publish: needs: diff --git a/.github/workflows/release-beta.yml b/.github/workflows/release-beta.yml index bc2601c0d2..e658a7614a 100644 --- a/.github/workflows/release-beta.yml +++ b/.github/workflows/release-beta.yml @@ -6,6 +6,9 @@ on: - develop workflow_dispatch: +permissions: + contents: write + jobs: release: name: semantic-release diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 8ef8b43834..369f0de896 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -6,6 +6,10 @@ on: - main workflow_call: +permissions: + contents: write + packages: write + jobs: settings: runs-on: ubuntu-latest diff --git a/.github/workflows/tag-npm.yml b/.github/workflows/tag-npm.yml index 9eda44cba3..5787562611 100644 --- a/.github/workflows/tag-npm.yml +++ b/.github/workflows/tag-npm.yml @@ -13,6 +13,9 @@ on: required: true type: string +permissions: + contents: read + jobs: tag: name: Move latest tag From 326dbae1d1e12ffbb8ce204962dbbd091200eb42 Mon Sep 17 00:00:00 2001 From: Qiao Han Date: Fri, 23 May 2025 22:36:33 +0800 Subject: [PATCH 2/3] fix: pnpm allow build flag --- .github/workflows/install.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/install.yml b/.github/workflows/install.yml index 85640211bd..2d079b7402 100644 --- a/.github/workflows/install.yml +++ b/.github/workflows/install.yml @@ -102,7 +102,7 @@ jobs: - run: npm install -g pnpm - run: pnpm init - - run: pnpm i --save-dev ./supabase-1.28.0.tgz + - run: pnpm i --save-dev ./supabase-1.28.0.tgz --allow-build=supabase - run: pnpm supabase --version bun: From eacec9f49bae27a5262fa2ca692822b83310e458 Mon Sep 17 00:00:00 2001 From: Qiao Han Date: Fri, 23 May 2025 22:43:16 +0800 Subject: [PATCH 3/3] chore: add comment --- .github/workflows/install.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/install.yml b/.github/workflows/install.yml index 2d079b7402..ee7c3e5ca4 100644 --- a/.github/workflows/install.yml +++ b/.github/workflows/install.yml @@ -102,6 +102,7 @@ jobs: - run: npm install -g pnpm - run: pnpm init + # https://github.com/pnpm/pnpm/issues/9124#issuecomment-2663021284 - run: pnpm i --save-dev ./supabase-1.28.0.tgz --allow-build=supabase - run: pnpm supabase --version