Skip to content

Commit 023ef52

Browse files
palattergithub-actions[bot]
palatter
and
github-actions[bot]
authored
[GitHub] Update workflows for new permission rules (#4046)
* Update update-api-files.yml Signed-off-by: Patrick Latter <73612854+palatter@users.noreply.github.com> * Update stress-test-ui-tests.yml Signed-off-by: Patrick Latter <73612854+palatter@users.noreply.github.com> * Update breaking-change-check.yml Signed-off-by: Patrick Latter <73612854+palatter@users.noreply.github.com> * Update update-api-files.yml Signed-off-by: Patrick Latter <73612854+palatter@users.noreply.github.com> * Update update-api-files.yml Signed-off-by: Patrick Latter <73612854+palatter@users.noreply.github.com> * Update beta API files * Update ci.yml Signed-off-by: Patrick Latter <73612854+palatter@users.noreply.github.com> * Update ci.yml Signed-off-by: Patrick Latter <73612854+palatter@users.noreply.github.com> * Update GH permissions for CI * Update permissions for workflows. * Change files * Duplicate change files for beta release * Delete test.txt Signed-off-by: Patrick Latter <73612854+palatter@users.noreply.github.com> * Update permission with read-all for testing * Update permissions in deploy workflow * Add read-all permissions to workflows * Update permissions in npm-release-publish.yml * Update update-api-files.yml Signed-off-by: Patrick Latter <73612854+palatter@users.noreply.github.com> * Update permissions in ci.yml file * Update permissions in CI workflow * Update permissions for pull requests * Delete change-beta/@azure-communication-react-1e9ee08b-b0d6-4834-adc3-3e041756647f.json Signed-off-by: Patrick Latter <73612854+palatter@users.noreply.github.com> * Delete change/@azure-communication-react-1e9ee08b-b0d6-4834-adc3-3e041756647f.json Signed-off-by: Patrick Latter <73612854+palatter@users.noreply.github.com> * Change files * Duplicate change files for beta release --------- Signed-off-by: Patrick Latter <73612854+palatter@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
1 parent 5020287 commit 023ef52

20 files changed

Lines changed: 101 additions & 11 deletions

‎.github/workflows/alpha-release.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ jobs:
1313
build_and_test:
1414
name: Build and Test
1515
runs-on: ubuntu-latest
16-
16+
permissions: read-all
1717
steps:
1818
# Check-out repo
1919
- uses: actions/checkout@v3

‎.github/workflows/breaking-change-check.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@ jobs:
2020
get_matrix:
2121
name: Load CI Matrix Details
2222
runs-on: ubuntu-latest
23+
permissions: read-all
2324
outputs:
2425
matrix: ${{ steps.get-matrix.outputs.matrix }}
2526
steps:
@@ -39,6 +40,7 @@ jobs:
3940
needs: get_matrix
4041
name: 'Check Breaking Changes (${{ matrix.flavor }})'
4142
runs-on: ubuntu-latest
43+
permissions: read-all
4244
strategy:
4345
matrix: ${{ fromJSON(needs.get_matrix.outputs.matrix) }}
4446
steps:

‎.github/workflows/ci.yml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,8 @@ concurrency:
1414
group: ${{ github.workflow }}-${{ github.ref }}
1515
cancel-in-progress: true
1616

17+
permissions: read-all
18+
1719
jobs:
1820
# get matrix for ci-jobs
1921
get_matrix:
@@ -128,6 +130,8 @@ jobs:
128130
if: ${{ github.event_name == 'pull_request' && !startsWith(github.event.pull_request.base.ref, 'release/') }}
129131
name: 'Jest Test Coverage (${{ matrix.flavor }})'
130132
runs-on: ubuntu-latest
133+
permissions:
134+
pull-requests: write
131135
strategy:
132136
matrix: ${{ fromJSON(needs.get_matrix.outputs.matrix) }}
133137
steps:
@@ -261,6 +265,8 @@ jobs:
261265
needs: get_matrix
262266
name: 'Call Composite automation test (${{ matrix.flavor }})'
263267
runs-on: ubuntu-latest
268+
permissions:
269+
pull-requests: write
264270
strategy:
265271
matrix: ${{ fromJSON(needs.get_matrix.outputs.matrix) }}
266272
steps:
@@ -339,6 +345,8 @@ jobs:
339345
needs: get_matrix
340346
name: 'Chat Composite automation test (${{ matrix.flavor }})'
341347
runs-on: ubuntu-latest
348+
permissions:
349+
pull-requests: write
342350
strategy:
343351
matrix: ${{ fromJSON(needs.get_matrix.outputs.matrix) }}
344352
steps:
@@ -417,6 +425,8 @@ jobs:
417425
needs: get_matrix
418426
name: 'Call With Chat Composite automation test (${{ matrix.flavor }})'
419427
runs-on: ubuntu-latest
428+
permissions:
429+
pull-requests: write
420430
strategy:
421431
matrix: ${{ fromJSON(needs.get_matrix.outputs.matrix) }}
422432
steps:
@@ -659,6 +669,8 @@ jobs:
659669
needs: get_matrix
660670
name: 'Build And Test Static HTML Composites Sample (${{ matrix.flavor }})'
661671
runs-on: ubuntu-latest
672+
permissions:
673+
pull-requests: write
662674
strategy:
663675
matrix: ${{ fromJSON(needs.get_matrix.outputs.matrix) }}
664676
steps:
@@ -721,6 +733,8 @@ jobs:
721733
needs: get_matrix
722734
name: 'Build And Test Component+Binding Examples (${{ matrix.flavor }})'
723735
runs-on: ubuntu-latest
736+
permissions:
737+
pull-requests: write
724738
strategy:
725739
matrix: ${{ fromJSON(needs.get_matrix.outputs.matrix) }}
726740
steps:
@@ -781,6 +795,8 @@ jobs:
781795
782796
compare_base_bundle_stats:
783797
runs-on: ubuntu-latest
798+
permissions:
799+
pull-requests: write
784800
if: ${{ github.event_name == 'pull_request' && !startsWith(github.event.pull_request.base.ref, 'release/') }}
785801
name: Compare bundle size from pr head ref to base ref - ${{ matrix.app }}
786802
needs: [build_calling_sample, build_chat_sample, build_call_with_chat_sample]
@@ -861,6 +877,8 @@ jobs:
861877

862878
check_failure:
863879
runs-on: ubuntu-latest
880+
permissions:
881+
issues: write
864882
needs:
865883
[build_packages, build_calling_sample, build_chat_sample, build_static_html_composites_sample, build_storybook]
866884
if: failure() && github.ref == 'refs/heads/main'

‎.github/workflows/create-api-view-feature-level.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@ concurrency:
1616
jobs:
1717
build:
1818
runs-on: ubuntu-latest
19+
permissions: read-all
1920
steps:
2021
# Checks-out your repository under $GITHUB_WORKSPACE so job can access it
2122
- uses: actions/checkout@v3

‎.github/workflows/create-prerelease-branch.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ jobs:
3232
create_pre-release:
3333
name: Bump versions and make changelog for release
3434
runs-on: ubuntu-latest
35-
35+
permissions: read-all
3636
steps:
3737
# Check-out repo
3838
- uses: actions/checkout@v3

‎.github/workflows/create-release-branch.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@ jobs:
1919
if: ${{ startsWith(github.event.inputs.branch, 'prerelease') }}
2020
name: Create release branch
2121
runs-on: ubuntu-latest
22+
permissions: read-all
2223
steps:
2324
# Check-out repo
2425
- uses: actions/checkout@v3

‎.github/workflows/deploy-azure-webapps.yml‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -15,14 +15,15 @@ concurrency:
1515
group: ${{ github.workflow }}-${{ github.ref }}
1616
cancel-in-progress: true
1717

18-
permissions:
19-
# Needed for Azure login
20-
id-token: write
18+
permissions: read-all
2119

2220
jobs:
2321
build-and-deploy-samples:
2422
name: Build and Deploy samples
2523
runs-on: ubuntu-latest
24+
permissions:
25+
# Needed for Azure login
26+
id-token: write
2627
environment: production
2728
steps:
2829
- uses: actions/checkout@v3
@@ -86,6 +87,8 @@ jobs:
8687

8788
check_failure:
8889
runs-on: ubuntu-latest
90+
permissions:
91+
issues: write
8992
needs: [build-and-deploy-samples]
9093
if: failure() && github.ref == 'refs/heads/main'
9194
name: File issue if Azure Deployment failed

‎.github/workflows/deploy-feature-azure-webapps.yml‎

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -9,14 +9,15 @@ concurrency:
99
group: ${{ github.workflow }}-${{ github.ref }}
1010
cancel-in-progress: true
1111

12-
permissions:
13-
# Needed for Azure login
14-
id-token: write
12+
permissions: read-all
1513

1614
jobs:
1715
calling:
1816
name: Build and Deploy Calling App
1917
runs-on: ubuntu-latest
18+
permissions:
19+
# Needed for Azure login
20+
id-token: write
2021
environment: staging
2122
steps:
2223
- uses: actions/checkout@v3
@@ -56,6 +57,9 @@ jobs:
5657
chat:
5758
name: Build and Deploy Chat App
5859
runs-on: ubuntu-latest
60+
permissions:
61+
# Needed for Azure login
62+
id-token: write
5963
environment: staging
6064
steps:
6165
- uses: actions/checkout@v3
@@ -95,6 +99,9 @@ jobs:
9599
callwithchat:
96100
name: Build and Deploy CallWithChat App
97101
runs-on: ubuntu-latest
102+
permissions:
103+
# Needed for Azure login
104+
id-token: write
98105
environment: staging
99106
steps:
100107
- uses: actions/checkout@v3

‎.github/workflows/deploy-release-azure-webapps.yml‎

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -13,14 +13,15 @@ concurrency:
1313
group: ${{ github.workflow }}-${{ github.ref }}
1414
cancel-in-progress: true
1515

16-
permissions:
17-
# Needed for Azure login
18-
id-token: write
16+
permissions: read-all
1917

2018
jobs:
2119
calling:
2220
name: Build and Deploy Calling App
2321
runs-on: ubuntu-latest
22+
permissions:
23+
# Needed for Azure login
24+
id-token: write
2425
environment: production
2526
steps:
2627
- uses: actions/checkout@v3
@@ -66,6 +67,9 @@ jobs:
6667
chat:
6768
name: Build and Deploy Chat App
6869
runs-on: ubuntu-latest
70+
permissions:
71+
# Needed for Azure login
72+
id-token: write
6973
environment: production
7074
steps:
7175
- uses: actions/checkout@v3
@@ -111,6 +115,9 @@ jobs:
111115
callwithchat:
112116
name: Build and Deploy CallWithChat App
113117
runs-on: ubuntu-latest
118+
permissions:
119+
# Needed for Azure login
120+
id-token: write
114121
environment: production
115122
steps:
116123
- uses: actions/checkout@v3

‎.github/workflows/deploy-storybook.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,9 @@ jobs:
1313
build-and-deploy-storybook:
1414
name: Build and Deploy Storybook
1515
runs-on: ubuntu-latest
16+
permissions: # permissions needed for the deploy-storybook script
17+
packages: write
18+
pull-requests: write
1619
steps:
1720
- uses: actions/checkout@v3
1821

0 commit comments

Comments
 (0)
⚡