ci(weekly-menu): assume the scoped role, add concurrency guard, pin actions

This commit is contained in:
Adam Moussa 2026-07-28 19:25:02 -04:00
parent 8272449ccf
commit 3952ed88f4

View file

@ -12,6 +12,10 @@ permissions:
id-token: write id-token: write
contents: read contents: read
concurrency:
group: weekly-menu
cancel-in-progress: false
jobs: jobs:
scrape-and-publish: scrape-and-publish:
runs-on: ubuntu-latest runs-on: ubuntu-latest
@ -31,10 +35,10 @@ jobs:
echo "SKIP_RUN=true" >> "$GITHUB_ENV" echo "SKIP_RUN=true" >> "$GITHUB_ENV"
fi fi
- uses: actions/checkout@v7 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
if: env.SKIP_RUN != 'true' if: env.SKIP_RUN != 'true'
- uses: actions/setup-python@v7 - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
if: env.SKIP_RUN != 'true' if: env.SKIP_RUN != 'true'
with: with:
python-version: '3.12' python-version: '3.12'
@ -49,7 +53,7 @@ jobs:
if: env.SKIP_RUN != 'true' if: env.SKIP_RUN != 'true'
uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6 uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6
with: with:
role-to-assume: ${{ secrets.AWS_DEPLOY_ROLE_ARN }} role-to-assume: ${{ secrets.AWS_WEEKLY_MENU_ROLE_ARN }}
aws-region: us-east-1 aws-region: us-east-1
- name: Scrape menu - name: Scrape menu