slawekjaranowski commented on code in PR #12581:
URL: https://github.com/apache/maven/pull/12581#discussion_r3672628206
##########
.github/workflows/pr-automation.yml:
##########
@@ -19,9 +19,15 @@ name: PR Automation
on:
pull_request_target:
types:
+ # zizmor: ignore[dangerous-triggers]
- closed
+permissions: {}
+
jobs:
pr-automation:
name: PR Automation
- uses: apache/maven-gh-actions-shared/.github/workflows/pr-automation.yml@v5
+ permissions:
+ issues: write
+ pull-requests: write
+ uses:
apache/maven-gh-actions-shared/.github/workflows/pr-automation.yml@8599b638c78a2bec146a98d75d4c8b4e8458324f
# v5
Review Comment:
It is intensionally here.
We assume our repo with shared actions is secure, we introduce every changes
to it.
When we pin to hash we need update about 100+ our repos in every changes in
shared actions.
We also manage permissions in shared action.
https://github.com/apache/maven-gh-actions-shared/blob/v5/.github/workflows/pr-automation.yml
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
