Skip to content

Commit b89c534

Browse files
authored
ci: reduce permissions on auto-labeler and set to not release (#38)
We were seeing random draft releases after a release occurred. I realized the auto-labeler workflow (also using draft-release action) was still doing a draft release. This was the culprit. By adding `disable-releaser: true`, we prevent this. Since this workflow no longer needs to create a release we can remove the `contents: write` permissions also. - [x] change image-name from hard-coded to github.repository in test-release Signed-off-by: jmeridth <[email protected]>
1 parent c180b53 commit b89c534

File tree

3 files changed

+2
-3
lines changed

3 files changed

+2
-3
lines changed

.github/workflows/auto-labeler.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,6 @@ permissions:
1414
jobs:
1515
main:
1616
permissions:
17-
contents: write
1817
pull-requests: write
1918
name: Auto label pull requests
2019
runs-on: ubuntu-latest
@@ -24,3 +23,4 @@ jobs:
2423
GITHUB_TOKEN: ${{ secrets.github-token }}
2524
with:
2625
config-name: ${{ inputs.config-name }}
26+
disable-releaser: true

.github/workflows/test-auto-labeler.yaml

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,6 @@ permissions:
99
jobs:
1010
auto_labeler:
1111
permissions:
12-
contents: write
1312
pull-requests: write
1413
uses: ./.github/workflows/auto-labeler.yaml
1514
with:

.github/workflows/test-release.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ jobs:
2626
attestations: write
2727
uses: ./.github/workflows/release-image.yaml
2828
with:
29-
image-name: github/ospo-reusable-workflows
29+
image-name: ${{ github.repository }}
3030
full-tag: ${{ needs.release.outputs.full-tag }}
3131
short-tag: ${{ needs.release.outputs.short-tag }}
3232
create-attestation: true

0 commit comments

Comments
 (0)