Xqt has submitted this change. ( https://gerrit.wikimedia.org/r/c/pywikibot/core/+/1295537?usp=email )

Change subject: tests: restrict all workflow permissions to `contents: read` ......................................................................

tests: restrict all workflow permissions to `contents: read`

This increases the security level of GitHub Actions runners.

Change-Id: Iac7034307adc9a8ee472bab17ddc2ea25e11c7cd --- M .github/workflows/doctest.yml M .github/workflows/graalpy_tests.yml M .github/workflows/login_tests-ci.yml M .github/workflows/oauth_tests-ci.yml M .github/workflows/pre-commit.yml M .github/workflows/pywikibot-ci.yml M .github/workflows/sysop_write_tests-ci.yml M .github/workflows/windows_tests.yml 8 files changed, 25 insertions(+), 3 deletions(-)

Approvals: jenkins-bot: Verified Xqt: Looks good to me, approved

diff --git a/.github/workflows/doctest.yml b/.github/workflows/doctest.yml index 0c65ec1..99051d7 100644 --- a/.github/workflows/doctest.yml +++ b/.github/workflows/doctest.yml @@ -10,14 +10,15 @@ group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true

+permissions: + contents: read + env: PYWIKIBOT_TEST_RUNNING: 1 PYWIKIBOT_USERNAME: Pywikibot-test

jobs: build: - permissions: - contents: read runs-on: ${{ matrix.os || 'ubuntu-latest' }} timeout-minutes: 10 strategy: diff --git a/.github/workflows/graalpy_tests.yml b/.github/workflows/graalpy_tests.yml index 0415b54..87f464b 100644 --- a/.github/workflows/graalpy_tests.yml +++ b/.github/workflows/graalpy_tests.yml @@ -10,6 +10,9 @@ group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true

+permissions: + contents: read + env: PYWIKIBOT_TEST_RUNNING: 1 PYWIKIBOT_USERNAME: Pywikibot-test diff --git a/.github/workflows/login_tests-ci.yml b/.github/workflows/login_tests-ci.yml index a39a5cc..0c13664 100644 --- a/.github/workflows/login_tests-ci.yml +++ b/.github/workflows/login_tests-ci.yml @@ -8,6 +8,9 @@ branches: [master] types: [completed]

+permissions: + contents: read + env: PYWIKIBOT_TEST_RUNNING: 1 PYWIKIBOT_TEST_LOGOUT: 1 diff --git a/.github/workflows/oauth_tests-ci.yml b/.github/workflows/oauth_tests-ci.yml index c82c657..9935398 100644 --- a/.github/workflows/oauth_tests-ci.yml +++ b/.github/workflows/oauth_tests-ci.yml @@ -10,6 +10,9 @@ group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true

+permissions: + contents: read + env: PYWIKIBOT_TEST_RUNNING: 1 PYWIKIBOT_USERNAME: Pywikibot-oauth diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml index 6bbf114..3ec3575 100644 --- a/.github/workflows/pre-commit.yml +++ b/.github/workflows/pre-commit.yml @@ -9,15 +9,18 @@ group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true

+permissions: + contents: read + env: PYWIKIBOT_TEST_RUNNING: 1 PYWIKIBOT_NO_USER_CONFIG: 2

jobs: pre-commit: - timeout-minutes: 10 runs-on: ${{ matrix.os || 'ubuntu-latest' }} continue-on-error: ${{ matrix.experimental || false }} + timeout-minutes: 10 strategy: fail-fast: false matrix: diff --git a/.github/workflows/pywikibot-ci.yml b/.github/workflows/pywikibot-ci.yml index a37a5cc..986e3eb 100644 --- a/.github/workflows/pywikibot-ci.yml +++ b/.github/workflows/pywikibot-ci.yml @@ -12,6 +12,9 @@ group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true

+permissions: + contents: read + env: PYWIKIBOT_TEST_RUNNING: 1 PYWIKIBOT_USERNAME: Pywikibot-test diff --git a/.github/workflows/sysop_write_tests-ci.yml b/.github/workflows/sysop_write_tests-ci.yml index 0070fc8..b77f89b 100644 --- a/.github/workflows/sysop_write_tests-ci.yml +++ b/.github/workflows/sysop_write_tests-ci.yml @@ -10,6 +10,9 @@ group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true

+permissions: + contents: read + env: PYWIKIBOT_TEST_RUNNING: 1 PYWIKIBOT_USERNAME: Pywikibot-test diff --git a/.github/workflows/windows_tests.yml b/.github/workflows/windows_tests.yml index 24ef712..7243a8d 100644 --- a/.github/workflows/windows_tests.yml +++ b/.github/workflows/windows_tests.yml @@ -10,6 +10,9 @@ group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true

+permissions: + contents: read + env: PYWIKIBOT_TEST_RUNNING: 1 PYWIKIBOT_USERNAME: Pywikibot-test