From ef05325ab7a72eaf6163d2fd0ff3214cffb0a753 Mon Sep 17 00:00:00 2001 From: Emilien Escalle Date: Mon, 9 Nov 2026 23:41:11 +0100 Subject: [PATCH] fix(ci): allow read-only reusable workflow callers --- ...__test-workflow-continuous-integration.yml | 12 ---------- .github/workflows/continuous-integration.md | 19 +++++++++------- .github/workflows/continuous-integration.yml | 22 +++++++++++-------- 3 files changed, 24 insertions(+), 29 deletions(-) diff --git a/.github/workflows/__test-workflow-continuous-integration.yml b/.github/workflows/__test-workflow-continuous-integration.yml index de2ab7db..0df6eb64 100644 --- a/.github/workflows/__test-workflow-continuous-integration.yml +++ b/.github/workflows/__test-workflow-continuous-integration.yml @@ -11,10 +11,7 @@ jobs: uses: $/.github/workflows/continuous-integration.yml permissions: contents: read - id-token: write packages: read - pull-requests: write - security-events: write with: working-directory: tests/continuous-integration build: "" @@ -28,10 +25,7 @@ jobs: uses: $/.github/workflows/continuous-integration.yml permissions: contents: read - id-token: write packages: read - pull-requests: write - security-events: write with: checks: false container: invalid.example.invalid/must-not-be-pulled:latest @@ -55,10 +49,7 @@ jobs: uses: $/.github/workflows/continuous-integration.yml permissions: contents: read - id-token: write packages: read - pull-requests: write - security-events: write with: working-directory: tests/source-package build: "" @@ -354,10 +345,7 @@ jobs: needs: arrange-with-container permissions: contents: read - id-token: write packages: read - pull-requests: write - security-events: write with: container: ${{ fromJSON(needs.arrange-with-container.outputs.built-images).ci-npm.images[0] }} working-directory: /usr/src/app/ diff --git a/.github/workflows/continuous-integration.md b/.github/workflows/continuous-integration.md index 1e6efe9e..b1d1e195 100644 --- a/.github/workflows/continuous-integration.md +++ b/.github/workflows/continuous-integration.md @@ -3,7 +3,7 @@ # GitHub Reusable Workflow: Node.js Continuous Integration
- Node.js Continuous Integration + Node.js Continuous Integration
--- @@ -16,7 +16,6 @@ [![License](https://img.shields.io/github/license/hoverkraft-tech/ci-github-nodejs)](http://choosealicense.com/licenses/mit/) [![Stars](https://img.shields.io/github/stars/hoverkraft-tech/ci-github-nodejs?style=social)](https://img.shields.io/github/stars/hoverkraft-tech/ci-github-nodejs?style=social) [![PRs Welcome](https://img.shields.io/badge/PRs-welcome-brightgreen.svg)](https://github.com/hoverkraft-tech/ci-github-nodejs/blob/main/CONTRIBUTING.md) -![GitHub Verified Creator](https://img.shields.io/badge/GitHub-Verified%20Creator-4493F8?logo=data:image/svg%2bxml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHZpZXdCb3g9IjAgMCAxNiAxNiIgd2lkdGg9IjE2IiBoZWlnaHQ9IjE2IiBmaWxsPSJyZ2IoNjgsIDE0NywgMjQ4KSI+CiAgPHBhdGggZD0ibTkuNTg1LjUyLjkyOS42OGMuMTUzLjExMi4zMzEuMTg2LjUxOC4yMTVsMS4xMzguMTc1YTIuNjc4IDIuNjc4IDAgMCAxIDIuMjQgMi4yNGwuMTc0IDEuMTM5Yy4wMjkuMTg3LjEwMy4zNjUuMjE1LjUxOGwuNjguOTI4YTIuNjc3IDIuNjc3IDAgMCAxIDAgMy4xN2wtLjY4LjkyOGExLjE3NCAxLjE3NCAwIDAgMC0uMjE1LjUxOGwtLjE3NSAxLjEzOGEyLjY3OCAyLjY3OCAwIDAgMS0yLjI0MSAyLjI0MWwtMS4xMzguMTc1YTEuMTcgMS4xNyAwIDAgMC0uNTE4LjIxNWwtLjkyOC42OGEyLjY3NyAyLjY3NyAwIDAgMS0zLjE3IDBsLS45MjgtLjY4YTEuMTc0IDEuMTc0IDAgMCAwLS41MTgtLjIxNUwzLjgzIDE0LjQxYTIuNjc4IDIuNjc4IDAgMCAxLTIuMjQtMi4yNGwtLjE3NS0xLjEzOGExLjE3IDEuMTcgMCAwIDAtLjIxNS0uNTE4bC0uNjgtLjkyOGEyLjY3NyAyLjY3NyAwIDAgMSAwLTMuMTdsLjY4LS45MjhjLjExMi0uMTUzLjE4Ni0uMzMxLjIxNS0uNTE4bC4xNzUtMS4xNGEyLjY3OCAyLjY3OCAwIDAgMSAyLjI0LTIuMjRsMS4xMzktLjE3NWMuMTg3LS4wMjkuMzY1LS4xMDMuNTE4LS4yMTVsLjkyOC0uNjhhMi42NzcgMi42NzcgMCAwIDEgMy4xNyAwWk03LjMwMyAxLjcyOGwtLjkyNy42OGEyLjY3IDIuNjcgMCAwIDEtMS4xOC40ODlsLTEuMTM3LjE3NGExLjE3OSAxLjE3OSAwIDAgMC0uOTg3Ljk4N2wtLjE3NCAxLjEzNmEyLjY3NyAyLjY3NyAwIDAgMS0uNDg5IDEuMThsLS42OC45MjhhMS4xOCAxLjE4IDAgMCAwIDAgMS4zOTRsLjY4LjkyN2MuMjU2LjM0OC40MjQuNzUzLjQ4OSAxLjE4bC4xNzQgMS4xMzdjLjA3OC41MDkuNDc4LjkwOS45ODcuOTg3bDEuMTM2LjE3NGEyLjY3IDIuNjcgMCAwIDEgMS4xOC40ODlsLjkyOC42OGMuNDE0LjMwNS45NzkuMzA1IDEuMzk0IDBsLjkyNy0uNjhhMi42NyAyLjY3IDAgMCAxIDEuMTgtLjQ4OWwxLjEzNy0uMTc0YTEuMTggMS4xOCAwIDAgMCAuOTg3LS45ODdsLjE3NC0xLjEzNmEyLjY3IDIuNjcgMCAwIDEgLjQ4OS0xLjE4bC42OC0uOTI4YTEuMTc2IDEuMTc2IDAgMCAwIDAtMS4zOTRsLS42OC0uOTI3YTIuNjg2IDIuNjg2IDAgMCAxLS40ODktMS4xOGwtLjE3NC0xLjEzN2ExLjE3OSAxLjE3OSAwIDAgMC0uOTg3LS45ODdsLTEuMTM2LS4xNzRhMi42NzcgMi42NzcgMCAwIDEtMS4xOC0uNDg5bC0uOTI4LS42OGExLjE3NiAxLjE3NiAwIDAgMC0xLjM5NCAwWk0xMS4yOCA2Ljc4bC0zLjc1IDMuNzVhLjc1Ljc1IDAgMCAxLTEuMDYgMEw0LjcyIDguNzhhLjc1MS43NTEgMCAwIDEgLjAxOC0xLjA0Mi43NTEuNzUxIDAgMCAxIDEuMDQyLS4wMThMNyA4Ljk0bDMuMjItMy4yMmEuNzUxLjc1MSAwIDAgMSAxLjA0Mi4wMTguNzUxLjc1MSAwIDAgMSAuMDE4IDEuMDQyWiI+PC9wYXRoPgo8L3N2Zz4K) @@ -35,13 +34,20 @@ Workflow to performs continuous integration steps against a Node.js project: - Build - Test +Set permissions on the calling job for the enabled features. Build, lint and +tests require contents: read and packages: read. CodeQL additionally requires +security-events: write; Codecov requires id-token: write; GitHub coverage +comments require pull-requests: write (unless using a separate github-token). +Disable coverage reporting with test: '{"coverage":null}' for read-only tests. +Test and CodeQL jobs inherit the caller's permissions; other jobs restrict +their permissions explicitly. Grant only the scopes your selected checks need. +The generated permission list below is the read-only baseline. Default checks +also need security-events: write and pull-requests: write on the calling job. + ### Permissions - **`contents`**: `read` -- **`id-token`**: `write` - **`packages`**: `read` -- **`pull-requests`**: `write` -- **`security-events`**: `write` @@ -61,10 +67,7 @@ jobs: uses: hoverkraft-tech/ci-github-nodejs/.github/workflows/continuous-integration.yml@02a04ad25ceaacdf3b7200e45fb7fec07fadf4fa # 2.1.0 permissions: contents: read - id-token: write packages: read - pull-requests: write - security-events: write secrets: # Secrets to be used during the build step. # Must be a multi-line env formatted string. diff --git a/.github/workflows/continuous-integration.yml b/.github/workflows/continuous-integration.yml index 80e6a09d..30197f15 100644 --- a/.github/workflows/continuous-integration.yml +++ b/.github/workflows/continuous-integration.yml @@ -4,6 +4,16 @@ # - Linting # - Build # - Test +# +# Set permissions on the calling job for the enabled features. Build, lint and +# tests require contents: read and packages: read. CodeQL additionally requires +# security-events: write; Codecov requires id-token: write; GitHub coverage +# comments require pull-requests: write (unless using a separate github-token). +# Disable coverage reporting with test: '{"coverage":null}' for read-only tests. +# Test and CodeQL jobs inherit the caller's permissions; other jobs restrict +# their permissions explicitly. Grant only the scopes your selected checks need. +# The generated permission list below is the read-only baseline. Default checks +# also need security-events: write and pull-requests: write on the calling job. name: Node.js Continuous Integration @@ -227,8 +237,7 @@ on: description: "ID of the build artifact) uploaded during the build step." value: ${{ jobs.build.outputs.artifact-id }} -permissions: {} - +# Optional reporting permissions are supplied by the calling job. jobs: prepare: name: 📦 Prepare configuration @@ -484,8 +493,7 @@ jobs: code-ql: name: 🛡️ CodeQL Analysis if: inputs.checks == true && inputs.code-ql != '' - permissions: - security-events: write + # Inherit the caller's permission grant when CodeQL is enabled. runs-on: *ci-runner steps: - uses: hoverkraft-tech/ci-github-common/actions/checkout@ce885f8dd6bf7191a79e3eebdf37bca805d40932 # 3.0.0 @@ -643,11 +651,7 @@ jobs: needs: - prepare - build - permissions: - contents: read - id-token: write # Required for Codecov uploads with OIDC authentication - packages: read - pull-requests: write + # Inherit the caller's reporting permissions; coverage can be disabled. steps: - uses: hoverkraft-tech/ci-github-common/actions/checkout@ce885f8dd6bf7191a79e3eebdf37bca805d40932 # 3.0.0 if: inputs.container == ''