@@ -2,83 +2,7 @@ name: Permissions
22on :
33 workflow_dispatch :
44
5- # Permissions can be defined at the workflow or job level
6- # https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/controlling-permissions-for-github_token
7- # ###############
8- # Full Set
9- # ###############
10- # permissions:
11- # actions: read|write|none
12- # attestations: read|write|none
13- # checks: read|write|none
14- # contents: read|write|none
15- # deployments: read|write|none
16- # id-token: write|none
17- # issues: read|write|none
18- # models: read|none
19- # discussions: read|write|none
20- # packages: read|write|none
21- # pages: read|write|none
22- # pull-requests: read|write|none
23- # security-events: read|write|none
24- # statuses: read|write|none
25- # ###############
26-
27- # ###############
28- # Default (everything unspecified is "none")
29- # ###############
30- # permissions:
31- # contents: read
32- # packages: read
33- # ###############
34-
355jobs :
36- read-only-pr :
37- runs-on : ubuntu-24.04
38- permissions :
39- pull-requests : read # Can read PR data only
40- continue-on-error : true # Avoids failing entire workflow
41- steps :
42- - uses : actions/checkout@v4
43-
44- - name : Install GitHub CLI
45- run : |
46- sudo apt-get update -qq
47- sudo apt-get install -y gh
48-
49- - name : List the first 5 open PRs (allowed)
50- run : gh pr list --limit 5
51- env :
52- GH_TOKEN : ${{ github.token }}
53-
54- - name : Attempt to add a label (expected to fail)
55- env :
56- GH_TOKEN : ${{ github.token }}
57- run : |
58- gh pr edit 1 --add-label "documentation"
59-
60- - name : Confirm the failure
61- if : failure()
62- run : echo "✅ Write operation was blocked as expected – token is read-only."
63-
64- read-write-pr :
65- runs-on : ubuntu-24.04
66- permissions :
67- pull-requests : write
68- steps :
69- - uses : actions/checkout@v4
70-
71- - name : Install GitHub CLI
72- run : |
73- sudo apt-get update -qq
74- sudo apt-get install -y gh
75-
76- - name : Attempt to add a label (expected to succeed)
77- env :
78- GH_TOKEN : ${{ github.token }}
79- run : |
80- gh pr edit 1 --add-label "documentation"
81-
826 # ❌ PLEASE DO NOT USE THIS APPROACH!
837 auth-to-aws-static :
848 runs-on : ubuntu-24.04
0 commit comments