Skip to content

Commit 4a0a321

Browse files
gforsythgforsyth
committed
refactor: add monitor as first step to every existing job instead
1 parent be66577 commit 4a0a321

19 files changed

Lines changed: 76 additions & 0 deletions

‎.github/workflows/breaking-change-alert.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,10 @@ jobs:
5757
notify-breaking-changes:
5858
runs-on: ubuntu-latest
5959
steps:
60+
- name: audit action permissions
61+
uses: GitHubSecurityLab/actions-permissions/monitor@bf82d13b9b10051d224345ab9184f5ede0a94289 # v1.0
62+
with:
63+
config: '{ "create_artifact": true, "enabled": true, "debug": false }'
6064
- name: Escape inputs for JSON
6165
id: escape
6266
env:

‎.github/workflows/build-devcontainer.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -70,6 +70,10 @@ jobs:
7070
tag: ${{ steps.build.outputs.tag }}
7171
version: ${{ steps.setup.outputs.version }}
7272
steps:
73+
- name: audit action permissions
74+
uses: GitHubSecurityLab/actions-permissions/monitor@bf82d13b9b10051d224345ab9184f5ede0a94289 # v1.0
75+
with:
76+
config: '{ "create_artifact": true, "enabled": true, "debug": false }'
7377
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
7478
with:
7579
fetch-depth: 0

‎.github/workflows/build-devcontainers.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,10 @@ jobs:
5050
runs-on: ubuntu-latest
5151
continue-on-error: true
5252
steps:
53+
- name: audit action permissions
54+
uses: GitHubSecurityLab/actions-permissions/monitor@bf82d13b9b10051d224345ab9184f5ede0a94289 # v1.0
55+
with:
56+
config: '{ "create_artifact": true, "enabled": true, "debug": false }'
5357
- id: vars
5458
name: Get image name, tags, and digests
5559
shell: bash --noprofile --norc -eo pipefail {0}

‎.github/workflows/build-in-devcontainer.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -99,6 +99,10 @@ jobs:
9999
runs-on: "linux-${{ matrix.ARCH }}-${{ inputs.node_type }}"
100100
name: "${{ matrix.ARCH }}, ${{ matrix.CUDA_VER }}, ${{ matrix.PACKAGER }}"
101101
steps:
102+
- name: audit action permissions
103+
uses: GitHubSecurityLab/actions-permissions/monitor@bf82d13b9b10051d224345ab9184f5ede0a94289 # v1.0
104+
with:
105+
config: '{ "create_artifact": true, "enabled": true, "debug": false }'
102106
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
103107
with:
104108
repository: ${{ inputs.repo }}

‎.github/workflows/changed-files.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,10 @@ jobs:
5757
outputs:
5858
changed_file_groups: ${{ steps.changed-files.outputs.changed_file_groups }}
5959
steps:
60+
- name: audit action permissions
61+
uses: GitHubSecurityLab/actions-permissions/monitor@bf82d13b9b10051d224345ab9184f5ede0a94289 # v1.0
62+
with:
63+
config: '{ "create_artifact": true, "enabled": true, "debug": false }'
6064
- name: Telemetry setup
6165
uses: rapidsai/shared-actions/telemetry-dispatch-setup@main
6266
continue-on-error: true

‎.github/workflows/checks.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,10 @@ jobs:
5454
env:
5555
RAPIDS_GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
5656
steps:
57+
- name: audit action permissions
58+
uses: GitHubSecurityLab/actions-permissions/monitor@bf82d13b9b10051d224345ab9184f5ede0a94289 # v1.0
59+
with:
60+
config: '{ "create_artifact": true, "enabled": true, "debug": false }'
5761
- name: Checkout code
5862
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
5963
with:

‎.github/workflows/compute-matrix.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,10 @@ jobs:
4848
outputs:
4949
matrix: ${{ steps.compute-matrix.outputs.matrix }}
5050
steps:
51+
- name: audit action permissions
52+
uses: GitHubSecurityLab/actions-permissions/monitor@bf82d13b9b10051d224345ab9184f5ede0a94289 # v1.0
53+
with:
54+
config: '{ "create_artifact": true, "enabled": true, "debug": false }'
5155
- name: Prepare Build Matrix
5256
id: prepare-matrix
5357
run: |

‎.github/workflows/conda-cpp-build.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -102,6 +102,10 @@ jobs:
102102
env:
103103
RAPIDS_BUILD_TYPE: ${{ inputs.build_type }}
104104
steps:
105+
- name: audit action permissions
106+
uses: GitHubSecurityLab/actions-permissions/monitor@bf82d13b9b10051d224345ab9184f5ede0a94289 # v1.0
107+
with:
108+
config: '{ "create_artifact": true, "enabled": true, "debug": false }'
105109
- uses: aws-actions/configure-aws-credentials@d979d5b3a71173a29b74b5b88418bfda9437d885 # v6.1.1
106110
with:
107111
role-to-assume: ${{ vars.AWS_ROLE_ARN }}

‎.github/workflows/conda-cpp-post-build-checks.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -58,6 +58,10 @@ jobs:
5858
env:
5959
RAPIDS_BUILD_TYPE: ${{ inputs.build_type }}
6060
steps:
61+
- name: audit action permissions
62+
uses: GitHubSecurityLab/actions-permissions/monitor@bf82d13b9b10051d224345ab9184f5ede0a94289 # v1.0
63+
with:
64+
config: '{ "create_artifact": true, "enabled": true, "debug": false }'
6165
- uses: aws-actions/configure-aws-credentials@d979d5b3a71173a29b74b5b88418bfda9437d885 # v6.1.1
6266
with:
6367
role-to-assume: ${{ vars.AWS_ROLE_ARN }}

‎.github/workflows/conda-cpp-tests.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -143,6 +143,10 @@ jobs:
143143
RAPIDS_BUILD_TYPE: ${{ inputs.build_type }}
144144
NVIDIA_VISIBLE_DEVICES: ${{ env.NVIDIA_VISIBLE_DEVICES }}
145145
steps:
146+
- name: audit action permissions
147+
uses: GitHubSecurityLab/actions-permissions/monitor@bf82d13b9b10051d224345ab9184f5ede0a94289 # v1.0
148+
with:
149+
config: '{ "create_artifact": true, "enabled": true, "debug": false }'
146150
- uses: aws-actions/configure-aws-credentials@d979d5b3a71173a29b74b5b88418bfda9437d885 # v6.1.1
147151
with:
148152
role-to-assume: ${{ vars.AWS_ROLE_ARN }}

0 commit comments

Comments
 (0)