Ci token protection fix (#244)

* Update _CI_coverage_compare.yml changing default permissions to only content:write * Update _CI_update.yml * Update CI.yml * Update _CI_coverage_compare.yml * Update _CI_update.yml * Update _CI_coverage_compare.yml * Update CI.yml * Update _CI_coverage_compare.yml
IntelLabs · Oct 28, 2024 · de38f03 · de38f03
1 parent 7d82ed1
commit de38f03
Show file tree

Hide file tree

Showing 3 changed files with 11 additions and 4 deletions.
diff --git a/.github/workflows/CI.yml b/.github/workflows/CI.yml
@@ -42,6 +42,11 @@ jobs:
     secrets: inherit
 
   Results:
+    permissions:
+      contents: write
+      issues: write
+      pull-requests: write
+
     # name: Compare code coverage
     needs: [Testing]
     uses: ./.github/workflows/_CI_coverage_compare.yml

diff --git a/.github/workflows/_CI_coverage_compare.yml b/.github/workflows/_CI_coverage_compare.yml
@@ -20,12 +20,13 @@ on:
         description: "The Python Coverage for source"
         type: string
 
-permissions: read-all
+permissions:
+  contents: write
+  issues: write
+  pull-requests: write
 
 jobs:
     compare_coverage:
-      permissions:
-        contents: write
       name: Compare Reported Coverage
       runs-on: ubuntu-latest
       steps:

diff --git a/.github/workflows/_CI_update.yml b/.github/workflows/_CI_update.yml
@@ -12,7 +12,8 @@ on:
           description: "Status of coverage tests (passed/failed)"
           type: string
 
-permissions: read-all
+permissions:
+  contents: write
 
 jobs:
     commit_job: