Skip to content

Commit 325f38b

Browse files
author
Joonas Hiltunen
committed
Add permissions
1 parent d5ce306 commit 325f38b

6 files changed

Lines changed: 69 additions & 62 deletions

‎.github/workflows/shared-build-and-publish-docker-image.yml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -24,22 +24,22 @@ on:
2424
description: Docker build context. This needs to be Git repository context; see https://docs.docker.com/build/concepts/context/#url-fragments
2525
type: string
2626
required: false
27-
default: null
27+
default: ""
2828
build_args:
2929
description: Docker build time arguments
3030
type: string
3131
required: false
32-
default: null
32+
default: ""
3333
target:
3434
description: Sets the target stage to build
3535
type: string
3636
required: false
37-
default: null
37+
default: ""
3838
artifact-id:
3939
description: Artifact ID needed to download for the build.
4040
type: string
4141
required: false
42-
default: null
42+
default: ""
4343
artifact-path:
4444
description: Target where to download the artifact.
4545
type: string
@@ -110,7 +110,7 @@ jobs:
110110
# Checkout is needed when context is local "."
111111
# Otherwise the repository code will not be fetched for the build
112112
if: ${{ inputs.context == '.' }}
113-
uses: actions/checkout@v5
113+
uses: actions/checkout@v6
114114

115115
- name: Download artifacts
116116
if: ${{ inputs.artifact-id }}

‎.github/workflows/shared-check-renovatebot-config.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,5 @@
11
name: Shared check renovatebot config
22

3-
permissions:
4-
contents: read
5-
63
on:
74
workflow_call:
85
inputs:
@@ -16,6 +13,9 @@ on:
1613
required: false
1714
default: "false"
1815

16+
permissions:
17+
contents: read
18+
1919
jobs:
2020
validate:
2121
name: Validate renovatebot config

‎.github/workflows/shared-codeql.yml‎

Lines changed: 10 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -21,19 +21,20 @@ on:
2121
type: string
2222
default: ""
2323

24+
permissions:
25+
# required for all workflows
26+
security-events: write
27+
# required to fetch internal or private CodeQL packs
28+
packages: read
29+
# only required for workflows in private repositories
30+
actions: read
31+
# repository contents
32+
contents: read
33+
2434
jobs:
2535
analyze:
2636
name: Analyze code
2737
runs-on: ubuntu-24.04
28-
permissions:
29-
# required for all workflows
30-
security-events: write
31-
# required to fetch internal or private CodeQL packs
32-
packages: read
33-
# only required for workflows in private repositories
34-
actions: read
35-
# repository contents
36-
contents: read
3738
strategy:
3839
fail-fast: false
3940
matrix:

‎.github/workflows/shared-run-e2e.yml‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,6 @@
11
---
22
name: Run E2E Tests
33

4-
permissions:
5-
contents: read
6-
74
on:
85
workflow_call:
96
inputs:
@@ -14,7 +11,7 @@ on:
1411
Git repository's main branch.
1512
type: string
1613
required: false
17-
default: null
14+
default: ""
1815
ui_version:
1916
description:
2017
Version of ui to use (docker image tag). Set to "" if using the default
@@ -146,6 +143,9 @@ on:
146143
description: SSH key that can be used to write to HSLdevcom/jore4-ci-data repository.
147144
required: false
148145

146+
permissions:
147+
contents: read
148+
149149
jobs:
150150
run_e2e_tests:
151151
name: Run e2e tests
@@ -233,7 +233,7 @@ jobs:
233233
cat ${{ github.workspace }}/durations.out.json
234234
235235
- name: Upload test durations
236-
uses: actions/upload-artifact@v4
236+
uses: actions/upload-artifact@v5
237237
with:
238238
name: "e2e-test-durations-${{ strategy.job-index }}"
239239
path: ${{ github.workspace }}/durations.out.json
@@ -249,7 +249,7 @@ jobs:
249249
- name: Upload test reports as an artifact
250250
# Should be run especially when tests fail
251251
if: always()
252-
uses: actions/upload-artifact@v4
252+
uses: actions/upload-artifact@v5
253253
with:
254254
name: cypress-test-results-${{ strategy.job-index }}
255255
path: ${{ github.workspace }}/ctrf-report.json
@@ -275,7 +275,7 @@ jobs:
275275
276276
- name: Upload test reports as an artifact
277277
if: always() && steps.copy_test_reports.outputs.test_reports_exist == 'true'
278-
uses: actions/upload-artifact@v4
278+
uses: actions/upload-artifact@v5
279279
with:
280280
name: cypress-docker-reports-${{ strategy.job-index }}
281281
path: ${{ github.workspace }}/test-reports
@@ -287,7 +287,7 @@ jobs:
287287
- run_e2e_tests
288288
steps:
289289
- name: Download E2E Test Results
290-
uses: actions/download-artifact@v4
290+
uses: actions/download-artifact@v5
291291
continue-on-error: true
292292
with:
293293
pattern: cypress-test-results-*
@@ -311,15 +311,15 @@ jobs:
311311
- run_e2e_tests
312312
steps:
313313
- name: Checkout
314-
uses: actions/checkout@v4
314+
uses: actions/checkout@v6
315315
with:
316316
fetch-depth: 0
317317
repository: "HSLdevcom/jore4-ci-data"
318318
ref: e2e-test-durations
319319
ssh-key: ${{ secrets.jore4_ci_data_repo_ssh_key }}
320320

321321
- name: Download E2E Test Durations
322-
uses: actions/download-artifact@v4
322+
uses: actions/download-artifact@v6
323323
with:
324324
pattern: e2e-test-durations-*
325325
path: ${{ github.workspace }}/split-durations

‎.github/workflows/test-healthcheck-action.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,9 @@ on:
66
- main
77
pull_request:
88

9+
permissions:
10+
contents: read
11+
912
jobs:
1013
test-healthcheck-success:
1114
name: Verifies whether healthcheck action succeeds when it should

‎.github/workflows/test-setup-e2e-environment-action.yml‎

Lines changed: 38 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,9 @@ on:
66
- main
77
pull_request:
88

9+
permissions:
10+
contents: read
11+
912
jobs:
1013
test-e2e-setup-action:
1114
runs-on: ubuntu-24.04
@@ -14,48 +17,48 @@ jobs:
1417
matrix:
1518
include:
1619
# no overwrites for images
17-
- ui-docker-image:
18-
hasura-docker-image:
19-
auth-docker-image:
20-
mbtiles-docker-image:
21-
jore3importer-docker-image:
22-
testdb-docker-image:
23-
mssqltestdb-docker-image:
24-
mapmatching-docker-image:
25-
mapmatchingdb-docker-image:
26-
cypress-docker-image:
27-
hastus-docker-image:
28-
custom-docker-compose:
20+
- ui-docker-image: ""
21+
hasura-docker-image: ""
22+
auth-docker-image: ""
23+
mbtiles-docker-image: ""
24+
jore3importer-docker-image: ""
25+
testdb-docker-image: ""
26+
mssqltestdb-docker-image: ""
27+
mapmatching-docker-image: ""
28+
mapmatchingdb-docker-image: ""
29+
cypress-docker-image: ""
30+
hastus-docker-image: ""
31+
custom-docker-compose: ""
2932
# overwrite some
3033
- ui-docker-image: "hsldevcom/jore4-ui:latest"
31-
hasura-docker-image:
32-
auth-docker-image:
33-
mbtiles-docker-image:
34-
jore3importer-docker-image:
35-
testdb-docker-image:
36-
mssqltestdb-docker-image:
37-
mapmatching-docker-image:
38-
mapmatchingdb-docker-image:
39-
cypress-docker-image:
40-
hastus-docker-image:
41-
custom-docker-compose:
34+
hasura-docker-image: ""
35+
auth-docker-image: ""
36+
mbtiles-docker-image: ""
37+
jore3importer-docker-image: ""
38+
testdb-docker-image: ""
39+
mssqltestdb-docker-image: ""
40+
mapmatching-docker-image: ""
41+
mapmatchingdb-docker-image: ""
42+
cypress-docker-image: ""
43+
hastus-docker-image: ""
44+
custom-docker-compose: ""
4245
# use custom docker-compose file
43-
- ui-docker-image:
44-
hasura-docker-image:
45-
auth-docker-image:
46-
mbtiles-docker-image:
47-
jore3importer-docker-image:
48-
testdb-docker-image:
49-
mssqltestdb-docker-image:
50-
mapmatching-docker-image:
51-
mapmatchingdb-docker-image:
52-
cypress-docker-image:
53-
hastus-docker-image:
46+
- ui-docker-image: ""
47+
hasura-docker-image: ""
48+
auth-docker-image: ""
49+
mbtiles-docker-image: ""
50+
jore3importer-docker-image: ""
51+
testdb-docker-image: ""
52+
mssqltestdb-docker-image: ""
53+
mapmatching-docker-image: ""
54+
mapmatchingdb-docker-image: ""
55+
cypress-docker-image: ""
56+
hastus-docker-image: ""
5457
custom-docker-compose: "custom-compose.yml" # this overwrites the hasura image to be "jore4-hasura:latest"
5558

5659
steps:
5760
- name: Checkout code
58-
uses: actions/checkout@v4
61+
uses: actions/checkout@v6
5962

6063
- name: Create a temporary custom docker compose file for testing
6164
run: |

0 commit comments

Comments
 (0)