chore(ci): separate permissions for build and publish jobs
Luke Karrys committed
Aug 11, 2022 at 15:39 UTC
b2d4eb3586cf63fffcdbf464ab96a592768a8da9
2 files changed
+10
-17
.github/workflows/publish.yml
+5
-11
@@ -1,25 +1,16 @@
1
name: Publish
2
3
-
3
on:
4
push:
5
branches:
6
- main
8
-
9
- # Allows you to run this workflow manually from the Actions tab
7
workflow_dispatch:
11
-
12
- # This gets called from the update-cli workflow
8
workflow_call:
9
15
-# Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages
16
-permissions:
17
- contents: read
18
- pages: write
19
- id-token: write
20
-
10
jobs:
11
build-and-upload:
12
+ permissions:
13
+ contents: read
14
runs-on: ubuntu-latest
15
steps:
16
# Check out the content (source branch)
@@ -46,6 +37,9 @@ jobs:
37
path: './public'
38
39
deploy:
40
+ permissions:
41
+ pages: write
42
+ id-token: write
43
environment:
44
name: github-pages
45
url: ${{ steps.deployment.outputs.page_url }}
.github/workflows/update-cli.yml
+5
-6
@@ -1,12 +1,9 @@
1
name: Update CLI
2
3
on:
4
+ workflow_dispatch:
5
schedule:
6
- cron: "14 2 * * *"
6
- workflow_dispatch:
7
-
8
-permissions:
9
- contents: write
7
8
jobs:
9
update-cli:
@@ -16,6 +13,10 @@ jobs:
13
steps:
14
- name: Check out source
15
uses: actions/checkout@v3
16
+ - name: Setup git user
17
+ run: |
18
+ git config --global user.email "npm-cli+bot@github.com"
19
+ git config --global user.name "npm CLI robot"
20
- name: Use Node.js
21
uses: actions/setup-node@v3
22
with:
@@ -38,8 +39,6 @@ jobs:
39
if: steps.status.outputs.has_changes == '1'
40
run: |
41
git add --verbose .
41
- git config user.name 'npm CLI robot'
42
- git config user.email 'npm-cli+bot@github.com'
42
git commit -m 'CLI documentation update from CI'
43
git push origin main
44