From f16749f67520ca7cf6754c6e5ac0fc2cb58ba4bb Mon Sep 17 00:00:00 2001 From: Marius Storhaug Date: Sat, 15 Aug 2026 19:19:21 +0200 Subject: [PATCH] Fix reusable workflow permissions Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .github/workflows/Build-Docs.yml | 1 - .github/workflows/Lint-Repository.yml | 4 +--- .github/workflows/Plan.yml | 1 - .github/workflows/Publish-Module.yml | 3 +-- .github/workflows/Workflow-Test-Default.yml | 4 +--- .github/workflows/Workflow-Test-WithManifest.yml | 4 +--- .github/workflows/workflow.yml | 4 +--- docs/content/get-started/repository-setup.md | 8 +++----- docs/content/guides/calling-the-workflow.md | 14 ++++++-------- docs/content/guides/github-app-authentication.md | 2 +- docs/content/reference/workflow-inputs.md | 8 +++----- 11 files changed, 18 insertions(+), 35 deletions(-) diff --git a/.github/workflows/Build-Docs.yml b/.github/workflows/Build-Docs.yml index 325888bb..bc173a90 100644 --- a/.github/workflows/Build-Docs.yml +++ b/.github/workflows/Build-Docs.yml @@ -10,7 +10,6 @@ on: permissions: contents: read # to checkout the repo - statuses: write # to create commit status jobs: Build-Docs: diff --git a/.github/workflows/Lint-Repository.yml b/.github/workflows/Lint-Repository.yml index 50aff226..8ed41fe8 100644 --- a/.github/workflows/Lint-Repository.yml +++ b/.github/workflows/Lint-Repository.yml @@ -9,9 +9,7 @@ on: required: true permissions: - contents: read # to checkout the repository - statuses: write # to update the status of the workflow from linter - pull-requests: write # to post super-linter summary comments on PRs + contents: read # to checkout the repository jobs: Lint-Repository: diff --git a/.github/workflows/Plan.yml b/.github/workflows/Plan.yml index 8e9b4657..0e0f1a7b 100644 --- a/.github/workflows/Plan.yml +++ b/.github/workflows/Plan.yml @@ -64,7 +64,6 @@ on: permissions: contents: read # to checkout the repo - pull-requests: write # to add labels / comments to PRs jobs: Plan: diff --git a/.github/workflows/Publish-Module.yml b/.github/workflows/Publish-Module.yml index a465df6f..49f747a3 100644 --- a/.github/workflows/Publish-Module.yml +++ b/.github/workflows/Publish-Module.yml @@ -25,8 +25,7 @@ jobs: name: Publish-Module runs-on: ubuntu-24.04 permissions: - contents: write # Create releases and upload release artifacts. - pull-requests: write # Comment on pull requests. + contents: read # Checkout uses github.token. env: SETTINGS: ${{ inputs.Settings }} steps: diff --git a/.github/workflows/Workflow-Test-Default.yml b/.github/workflows/Workflow-Test-Default.yml index 03fd212b..b9d065b7 100644 --- a/.github/workflows/Workflow-Test-Default.yml +++ b/.github/workflows/Workflow-Test-Default.yml @@ -35,9 +35,7 @@ concurrency: cancel-in-progress: false permissions: - contents: write - pull-requests: write - statuses: write + contents: read pages: write id-token: write diff --git a/.github/workflows/Workflow-Test-WithManifest.yml b/.github/workflows/Workflow-Test-WithManifest.yml index a9662438..ae739e8a 100644 --- a/.github/workflows/Workflow-Test-WithManifest.yml +++ b/.github/workflows/Workflow-Test-WithManifest.yml @@ -35,9 +35,7 @@ concurrency: cancel-in-progress: false permissions: - contents: write - pull-requests: write - statuses: write + contents: read pages: write id-token: write diff --git a/.github/workflows/workflow.yml b/.github/workflows/workflow.yml index 233de005..db9a0999 100644 --- a/.github/workflows/workflow.yml +++ b/.github/workflows/workflow.yml @@ -69,9 +69,7 @@ on: ^README\.md$ permissions: - contents: write # to checkout the repo and create releases on the repo - pull-requests: write # to write comments to PRs - statuses: write # to update the status of the workflow from linter + contents: read # to checkout the repo pages: write # to deploy to Pages id-token: write # to verify the deployment originates from an appropriate source diff --git a/docs/content/get-started/repository-setup.md b/docs/content/get-started/repository-setup.md index d8fbabaa..790cf5ea 100644 --- a/docs/content/get-started/repository-setup.md +++ b/docs/content/get-started/repository-setup.md @@ -57,22 +57,20 @@ concurrency: cancel-in-progress: false permissions: - contents: write - pull-requests: write - statuses: write + contents: read pages: write id-token: write jobs: Process-PSModule: - uses: PSModule/Process-PSModule/.github/workflows/workflow.yml@v5 + uses: PSModule/Process-PSModule/.github/workflows/workflow.yml@v8 secrets: PSGALLERY_API_KEY: ${{ secrets.PSGALLERY_API_KEY }} GitHubAppClientId: ${{ secrets.SHELLY_CLIENT_ID }} GitHubAppPrivateKey: ${{ secrets.SHELLY_PRIVATE_KEY }} ``` -Every permission in that block is required. A push to `main` publishes a stable release after the full pipeline passes; +Every permission in that block is required. GitHub App installation tokens perform repository writes. A push to `main` publishes a stable release after the full pipeline passes; the pull-request trigger handles CI, prereleases, and prerelease cleanup. See [Workflow inputs](../reference/workflow-inputs.md) for what each permission is used for, and [Calling the workflow](../guides/calling-the-workflow.md) for passing test secrets and variables. diff --git a/docs/content/guides/calling-the-workflow.md b/docs/content/guides/calling-the-workflow.md index e9bb9e85..8e18d7e1 100644 --- a/docs/content/guides/calling-the-workflow.md +++ b/docs/content/guides/calling-the-workflow.md @@ -40,15 +40,13 @@ concurrency: cancel-in-progress: false permissions: - contents: write - pull-requests: write - statuses: write + contents: read pages: write id-token: write jobs: Process-PSModule: - uses: PSModule/Process-PSModule/.github/workflows/workflow.yml@v5 + uses: PSModule/Process-PSModule/.github/workflows/workflow.yml@v8 secrets: PSGALLERY_API_KEY: ${{ secrets.PSGALLERY_API_KEY }} GitHubAppClientId: ${{ secrets.SHELLY_CLIENT_ID }} @@ -94,7 +92,7 @@ changes: ```yaml jobs: Process-PSModule: - uses: PSModule/Process-PSModule/.github/workflows/workflow.yml@v5 + uses: PSModule/Process-PSModule/.github/workflows/workflow.yml@v8 secrets: PSGALLERY_API_KEY: ${{ secrets.PSGALLERY_API_KEY }} GitHubAppClientId: ${{ secrets.SHELLY_CLIENT_ID }} @@ -123,7 +121,7 @@ content lines stay at the same indentation level: ```yaml jobs: Process-PSModule: - uses: PSModule/Process-PSModule/.github/workflows/workflow.yml@v5 + uses: PSModule/Process-PSModule/.github/workflows/workflow.yml@v8 secrets: PSGALLERY_API_KEY: ${{ secrets.PSGALLERY_API_KEY }} GitHubAppClientId: ${{ secrets.SHELLY_CLIENT_ID }} @@ -235,7 +233,7 @@ You can also pass patterns via the workflow input: ```yaml jobs: Process: - uses: PSModule/Process-PSModule/.github/workflows/workflow.yml@v5 + uses: PSModule/Process-PSModule/.github/workflows/workflow.yml@v8 with: ImportantFilePatterns: | ^src/ @@ -248,7 +246,7 @@ To disable triggering via the workflow input, pass an explicit empty string: ```yaml jobs: process: - uses: PSModule/Process-PSModule/.github/workflows/workflow.yml@v5 + uses: PSModule/Process-PSModule/.github/workflows/workflow.yml@v8 with: ImportantFilePatterns: '' ``` diff --git a/docs/content/guides/github-app-authentication.md b/docs/content/guides/github-app-authentication.md index 7be1620b..cf35933a 100644 --- a/docs/content/guides/github-app-authentication.md +++ b/docs/content/guides/github-app-authentication.md @@ -23,7 +23,7 @@ names. Map the caller's secrets explicitly: ```yaml jobs: Process-PSModule: - uses: PSModule/Process-PSModule/.github/workflows/workflow.yml@v5 + uses: PSModule/Process-PSModule/.github/workflows/workflow.yml@v8 secrets: PSGALLERY_API_KEY: ${{ secrets.PSGALLERY_API_KEY }} GitHubAppClientId: ${{ secrets.SHELLY_CLIENT_ID }} diff --git a/docs/content/reference/workflow-inputs.md b/docs/content/reference/workflow-inputs.md index dd290c06..a7c0d932 100644 --- a/docs/content/reference/workflow-inputs.md +++ b/docs/content/reference/workflow-inputs.md @@ -37,14 +37,12 @@ See [passing test data](../guides/calling-the-workflow.md#passing-test-data) for ## Workflow `github.token` permissions -The following permissions are needed by the caller workflow's default `github.token` for operations that do not use -Shelly, such as linting and GitHub Pages deployment: +The following permissions are needed by the caller workflow's default `github.token` for checkout and GitHub Pages +deployment: ```yaml permissions: - contents: write # to checkout the repo and create releases on the repo - pull-requests: write # to write comments to PRs - statuses: write # to update the status of the workflow from linter + contents: read # to checkout the repo pages: write # to deploy to Pages id-token: write # to verify the Pages deployment originates from an appropriate source ```