mirror of
https://github.com/Sea-Haven-Industries/.github.git
synced 2026-09-30 07:03:11 +00:00
Adam Moussa
1562cbda8e
ci-python-sam, ci-typescript-cdk and ci-dotnet declared no permissions at any level, unlike every other workflow here. A reusable workflow that declares nothing inherits the CALLER's token scopes, and these are called from deploy repos, so a lint/test/synth job could run holding an OIDC-mintable token it has no use for. None of the three references GITHUB_TOKEN, github.token, gh, or any secret, so contents:read is all they need to check out and build. Also pass node-version explicitly in the cdk-deploy and ci-node templates. cicd.md requires callers to pin it so lockfileVersion 3 from local Node 24 / npm 11 cannot drift from the runner, but no template did. Only these two targets accept the input; sam-deploy, dotnet-eb, dependency-review and labeler do not, so they are left alone. Verified against all 22 callers across the org that none grants permissions omitting contents:read, so no repo's CI breaks on the caller-cannot-be-exceeded rule.
14 lines
454 B
YAML
14 lines
454 B
YAML
name: Deploy (CDK)
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
|
|
jobs:
|
|
deploy:
|
|
uses: Sea-Haven-Industries/.github/.github/workflows/cd-cdk.yaml@555d07c3a240689a81668026787eba089df4c975 # main
|
|
with:
|
|
# Matches local dev (Node 24 / npm 11, lockfileVersion 3). This is also the
|
|
# reusable workflow's default — passed explicitly to pin against drift.
|
|
node-version: "24"
|
|
secrets:
|
|
deploy-role-arn: ${{ secrets.AWS_DEPLOY_ROLE_ARN }}
|