Xqt has submitted this change. ( https://gerrit.wikimedia.org/r/c/pywikibot/core/+/1295533?usp=email )

Change subject: tests: set GitHub action persist-credentials to false ......................................................................

tests: set GitHub action persist-credentials to false

Also restrict the doctest workflow permissions to `contents: read` for testing purposes.

This increases the security level of GitHub Actions runners.

Change-Id: Ie63a703b171efe566be3bd570611c4070fc3f25c --- M .github/workflows/doctest.yml M .github/workflows/graalpy_tests.yml M .github/workflows/login_tests-ci.yml M .github/workflows/oauth_tests-ci.yml M .github/workflows/pre-commit.yml M .github/workflows/pywikibot-ci.yml M .github/workflows/sysop_write_tests-ci.yml M .github/workflows/windows_tests.yml 8 files changed, 10 insertions(+), 0 deletions(-)

Approvals: Xqt: Looks good to me, approved jenkins-bot: Verified

diff --git a/.github/workflows/doctest.yml b/.github/workflows/doctest.yml index 4e48263..0c65ec1 100644 --- a/.github/workflows/doctest.yml +++ b/.github/workflows/doctest.yml @@ -16,6 +16,8 @@

jobs: build: + permissions: + contents: read runs-on: ${{ matrix.os || 'ubuntu-latest' }} timeout-minutes: 10 strategy: @@ -35,6 +37,7 @@ uses: actions/checkout@v6 with: submodules: true + persist-credentials: false - name: Set up Python ${{ matrix.python-version }} uses: actions/setup-python@v6 with: diff --git a/.github/workflows/graalpy_tests.yml b/.github/workflows/graalpy_tests.yml index e0d0672..0415b54 100644 --- a/.github/workflows/graalpy_tests.yml +++ b/.github/workflows/graalpy_tests.yml @@ -31,6 +31,7 @@ uses: actions/checkout@v6 with: submodules: true + persist-credentials: false - name: Set up Python ${{ matrix.python-version }} uses: actions/setup-python@v6 with: diff --git a/.github/workflows/login_tests-ci.yml b/.github/workflows/login_tests-ci.yml index e15a828..a39a5cc 100644 --- a/.github/workflows/login_tests-ci.yml +++ b/.github/workflows/login_tests-ci.yml @@ -83,6 +83,7 @@ uses: actions/checkout@v6 with: submodules: true + persist-credentials: false - name: Set up Python ${{ matrix.python-version }} uses: actions/setup-python@v6 with: diff --git a/.github/workflows/oauth_tests-ci.yml b/.github/workflows/oauth_tests-ci.yml index 550c38a..c82c657 100644 --- a/.github/workflows/oauth_tests-ci.yml +++ b/.github/workflows/oauth_tests-ci.yml @@ -49,6 +49,7 @@ uses: actions/checkout@v6 with: submodules: true + persist-credentials: false - name: Set up Python ${{ matrix.python-version }} uses: actions/setup-python@v6 with: diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml index 6235209..6bbf114 100644 --- a/.github/workflows/pre-commit.yml +++ b/.github/workflows/pre-commit.yml @@ -37,6 +37,7 @@ uses: actions/checkout@v6 with: submodules: true + persist-credentials: false - name: run pre-commit uses: pre-commit/action@v3.0.1 env: diff --git a/.github/workflows/pywikibot-ci.yml b/.github/workflows/pywikibot-ci.yml index 0cdd09e..a37a5cc 100644 --- a/.github/workflows/pywikibot-ci.yml +++ b/.github/workflows/pywikibot-ci.yml @@ -76,6 +76,7 @@ uses: actions/checkout@v6 with: submodules: true + persist-credentials: false - name: Set up Python ${{ matrix.python-version }} uses: actions/setup-python@v6 with: diff --git a/.github/workflows/sysop_write_tests-ci.yml b/.github/workflows/sysop_write_tests-ci.yml index 609027e..0070fc8 100644 --- a/.github/workflows/sysop_write_tests-ci.yml +++ b/.github/workflows/sysop_write_tests-ci.yml @@ -30,6 +30,7 @@ uses: actions/checkout@v6 with: submodules: true + persist-credentials: false - name: Set up Python ${{ matrix.python-version }} uses: actions/setup-python@v6 with: diff --git a/.github/workflows/windows_tests.yml b/.github/workflows/windows_tests.yml index 8d5bef1..24ef712 100644 --- a/.github/workflows/windows_tests.yml +++ b/.github/workflows/windows_tests.yml @@ -30,6 +30,7 @@ uses: actions/checkout@v6 with: submodules: true + persist-credentials: false - name: Set up Python ${{ matrix.python-version }} uses: actions/setup-python@v6 with: