Xqt submitted this change.

View Change

tests: set GitHub action persist-credentials to false

Also restrict the doctest workflow permissions to `contents: read`
for testing purposes.

This increases the security level of GitHub Actions runners.

Change-Id: Ie63a703b171efe566be3bd570611c4070fc3f25c
---
M .github/workflows/doctest.yml
M .github/workflows/graalpy_tests.yml
M .github/workflows/login_tests-ci.yml
M .github/workflows/oauth_tests-ci.yml
M .github/workflows/pre-commit.yml
M .github/workflows/pywikibot-ci.yml
M .github/workflows/sysop_write_tests-ci.yml
M .github/workflows/windows_tests.yml
8 files changed, 10 insertions(+), 0 deletions(-)

diff --git a/.github/workflows/doctest.yml b/.github/workflows/doctest.yml
index 4e48263..0c65ec1 100644
--- a/.github/workflows/doctest.yml
+++ b/.github/workflows/doctest.yml
@@ -16,6 +16,8 @@
 
 jobs:
   build:
+    permissions:
+      contents: read
     runs-on: ${{ matrix.os || 'ubuntu-latest' }}
     timeout-minutes: 10
     strategy:
@@ -35,6 +37,7 @@
         uses: actions/checkout@v6
         with:
           submodules: true
+          persist-credentials: false
       - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@v6
         with:
diff --git a/.github/workflows/graalpy_tests.yml b/.github/workflows/graalpy_tests.yml
index e0d0672..0415b54 100644
--- a/.github/workflows/graalpy_tests.yml
+++ b/.github/workflows/graalpy_tests.yml
@@ -31,6 +31,7 @@
         uses: actions/checkout@v6
         with:
           submodules: true
+          persist-credentials: false
       - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@v6
         with:
diff --git a/.github/workflows/login_tests-ci.yml b/.github/workflows/login_tests-ci.yml
index e15a828..a39a5cc 100644
--- a/.github/workflows/login_tests-ci.yml
+++ b/.github/workflows/login_tests-ci.yml
@@ -83,6 +83,7 @@
         uses: actions/checkout@v6
         with:
           submodules: true
+          persist-credentials: false
       - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@v6
         with:
diff --git a/.github/workflows/oauth_tests-ci.yml b/.github/workflows/oauth_tests-ci.yml
index 550c38a..c82c657 100644
--- a/.github/workflows/oauth_tests-ci.yml
+++ b/.github/workflows/oauth_tests-ci.yml
@@ -49,6 +49,7 @@
         uses: actions/checkout@v6
         with:
           submodules: true
+          persist-credentials: false
       - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@v6
         with:
diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml
index 6235209..6bbf114 100644
--- a/.github/workflows/pre-commit.yml
+++ b/.github/workflows/pre-commit.yml
@@ -37,6 +37,7 @@
         uses: actions/checkout@v6
         with:
           submodules: true
+          persist-credentials: false
       - name: run pre-commit
         uses: pre-commit/action@v3.0.1
         env:
diff --git a/.github/workflows/pywikibot-ci.yml b/.github/workflows/pywikibot-ci.yml
index 0cdd09e..a37a5cc 100644
--- a/.github/workflows/pywikibot-ci.yml
+++ b/.github/workflows/pywikibot-ci.yml
@@ -76,6 +76,7 @@
         uses: actions/checkout@v6
         with:
           submodules: true
+          persist-credentials: false
       - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@v6
         with:
diff --git a/.github/workflows/sysop_write_tests-ci.yml b/.github/workflows/sysop_write_tests-ci.yml
index 609027e..0070fc8 100644
--- a/.github/workflows/sysop_write_tests-ci.yml
+++ b/.github/workflows/sysop_write_tests-ci.yml
@@ -30,6 +30,7 @@
         uses: actions/checkout@v6
         with:
           submodules: true
+          persist-credentials: false
       - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@v6
         with:
diff --git a/.github/workflows/windows_tests.yml b/.github/workflows/windows_tests.yml
index 8d5bef1..24ef712 100644
--- a/.github/workflows/windows_tests.yml
+++ b/.github/workflows/windows_tests.yml
@@ -30,6 +30,7 @@
         uses: actions/checkout@v6
         with:
           submodules: true
+          persist-credentials: false
       - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@v6
         with:

To view, visit change 1295533. To unsubscribe, or for help writing mail filters, visit settings.