ci: scope the write permission to the job that uses it - #143
Merged
Conversation
The dapper half of the same change on main. cleanup-runs.yml declared
actions: write at the workflow level, where it applies to every job the file
will ever contain; it now sits on the single job that needs it, with the
workflow level dropped to contents: read.
The scope itself stays, because dropping it breaks the workflow: it is used by
exactly one step, "Delete old runs of the high-frequency workflows"
(DELETE /repos/{repo}/actions/runs/{id}), which is the entire job.
dependabot-lockfix.yml has no counterpart here by design — workflow_run fires
only from the default branch's copy, and that one already serves Dependabot
branches based on either branch.
Behaviour is unchanged.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019h7znwAftvs36vD4YwKMRf
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The
dapperhalf of #142.cleanup-runs.ymldeclaredactions: writeat the workflow level, where it applies to every job the file will ever contain. It now sits on the single job that needs it, with the workflow level dropped tocontents: read.The scope itself stays, because dropping it breaks the workflow. It is used by exactly one step — "Delete old runs of the high-frequency workflows" (
DELETE /repos/{repo}/actions/runs/{id}) — which is the entire job.Behaviour is unchanged; the existing job resolves to exactly what it had before.
dependabot-lockfix.ymlhas no counterpart on this branch by design —workflow_runfires only from the default branch's copy, and that one already serves Dependabot branches based on either branch.🤖 Generated with Claude Code
https://claude.ai/code/session_019h7znwAftvs36vD4YwKMRf
Generated by Claude Code