mirror of
https://github.com/Sea-Haven-Industries/.github.git
synced 2026-09-30 09:23:11 +00:00
Adam Moussa
1562cbda8e
ci-python-sam, ci-typescript-cdk and ci-dotnet declared no permissions at any level, unlike every other workflow here. A reusable workflow that declares nothing inherits the CALLER's token scopes, and these are called from deploy repos, so a lint/test/synth job could run holding an OIDC-mintable token it has no use for. None of the three references GITHUB_TOKEN, github.token, gh, or any secret, so contents:read is all they need to check out and build. Also pass node-version explicitly in the cdk-deploy and ci-node templates. cicd.md requires callers to pin it so lockfileVersion 3 from local Node 24 / npm 11 cannot drift from the runner, but no template did. Only these two targets accept the input; sam-deploy, dotnet-eb, dependency-review and labeler do not, so they are left alone. Verified against all 22 callers across the org that none grants permissions omitting contents:read, so no repo's CI breaks on the caller-cannot-be-exceeded rule. |
||
|---|---|---|
| .. | ||
| cdk-deploy.properties.json | ||
| cdk-deploy.yml | ||
| ci-node.properties.json | ||
| ci-node.yml | ||
| ci-python.properties.json | ||
| ci-python.yml | ||
| dependency-review.properties.json | ||
| dependency-review.yml | ||
| dotnet-eb-deploy.properties.json | ||
| dotnet-eb-deploy.yml | ||
| labeler.properties.json | ||
| labeler.yml | ||
| sam-deploy.properties.json | ||
| sam-deploy.yml | ||
| triage.properties.json | ||
| triage.yml | ||