Browse Source

chore: update GitHub Actions workflows for permissions and token usage

- Changed permissions in auto-tag.yml and release.yml to 'write-all' for broader access.
- Updated GITHUB_TOKEN to use RELEASE_TOKEN in both workflows for enhanced security.
- Streamlined the workflows by removing redundant permission specifications.
pull/122/head v0.0.9
煎饼果子卷鲨鱼辣椒 5 months ago
parent
commit
dff58fb4fb
  1. 14
      .github/workflows/auto-tag.yml
  2. 8
      .github/workflows/release.yml

14
.github/workflows/auto-tag.yml

@ -10,13 +10,11 @@ on:
- "LICENSE"
- ".gitignore"
permissions: write-all
jobs:
auto-tag:
runs-on: ubuntu-latest
permissions:
contents: write
issues: write
pull-requests: write
outputs:
new_tag: ${{ steps.get_latest_tag.outputs.version }}
steps:
@ -41,7 +39,7 @@ jobs:
- name: Create new tag
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
GITHUB_TOKEN: ${{ secrets.RELEASE_TOKEN }}
run: |
new_tag=${{ steps.get_latest_tag.outputs.version }}
git config --global user.name 'github-actions[bot]'
@ -52,9 +50,5 @@ jobs:
release:
needs: auto-tag
uses: ./.github/workflows/release.yml
permissions:
contents: write
packages: write
issues: write
pull-requests: write
permissions: write-all
secrets: inherit

8
.github/workflows/release.yml

@ -6,11 +6,7 @@ on:
tags:
- "v*"
permissions:
contents: write
packages: write
issues: write
pull-requests: write
permissions: write-all
jobs:
goreleaser:
@ -51,5 +47,5 @@ jobs:
version: v1.21.2
args: release --clean
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
GITHUB_TOKEN: ${{ secrets.RELEASE_TOKEN }}
GPG_FINGERPRINT: ${{ steps.import_gpg.outputs.fingerprint }}
Loading…
Cancel
Save