aleleba/cadcraft
1
0
Fork 0
mirror of https://github.com/storytold/cadcraft.git synced 2026-10-24 02:46:51 -06:00
Code Issues Packages Projects Releases Wiki Activity

security: write the release from the release job only (SonarCloud S8233) (#2021)

Browse Source 
The workflow-level contents: write granted every job the right to push
tags and releases; the reusable release workflow is the only job that
needs it. Workflow level drops to read.

🤖 Generated with Codebuff

Co-authored-by: Codebuff <noreply@codebuff.com>
This commit is contained in:
Dylan M. Taylor
2026-10-23 17:28:41 -04:00
committed by GitHub
co-authored by Codebuff
parent c1dd60ffd6
commit 7bf5905ac9
1 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/release.yml
+4 -1
View File
@@ -11,7 +11,7 @@ on:
default: "" default: ""
permissions: permissions:
contents: write contents: read
concurrency: concurrency:
group: release-${{ github.ref }} group: release-${{ github.ref }}
@@ -59,6 +59,9 @@ jobs:
release: release:
needs: git-sources needs: git-sources
permissions:
# The reusable release workflow tags and uploads the draft release.
contents: write
# Intentionally tracked at @main (not SHA-pinned) so org-wide CI improvements, security fixes, and build optimizations propagate without PR churn across all craftapp repos. # Intentionally tracked at @main (not SHA-pinned) so org-wide CI improvements, security fixes, and build optimizations propagate without PR churn across all craftapp repos.
uses: storytold/craft-common-actions/.github/workflows/release.yml@main uses: storytold/craft-common-actions/.github/workflows/release.yml@main
with: with: