rmannibucau commented on code in PR #12581:
URL: https://github.com/apache/maven/pull/12581#discussion_r3672779767
##########
.github/workflows/pr-automation.yml:
##########
@@ -19,9 +19,15 @@ name: PR Automation
on:
pull_request_target:
types:
+ # zizmor: ignore[dangerous-triggers]
- closed
+permissions: {}
+
jobs:
pr-automation:
name: PR Automation
- uses: apache/maven-gh-actions-shared/.github/workflows/pr-automation.yml@v5
+ permissions:
+ issues: write
+ pull-requests: write
+ uses:
apache/maven-gh-actions-shared/.github/workflows/pr-automation.yml@8599b638c78a2bec146a98d75d4c8b4e8458324f
# v5
Review Comment:
I understand but I dont think we should auto upgrade all repos like that,
this is a good idea today which will likely blow up tomorrow so better to
invest in automating it with a workflow in shared repo (on demand/manual) than
relying on it by default IMHO
permissions being per workflow/job it is always better to explicit it in
leaves than in parents IMHO, in particular when there it does have some serious
impact on the run of the workflow (not having write perms will fail and you can
wonder why - would be ok only if read only for PR IMHO)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
