From 04edaeb4ab84f041310f1e38f4d75065cbce8ee3 Mon Sep 17 00:00:00 2001 From: James Titcumb Date: Tue, 6 May 2025 22:12:07 +0100 Subject: [PATCH 1/3] Add permissions for creating issues to trusted root cert check job --- .github/workflows/check-outdated-trusted-root.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/check-outdated-trusted-root.yml b/.github/workflows/check-outdated-trusted-root.yml index aa46d5fb..9d95171e 100644 --- a/.github/workflows/check-outdated-trusted-root.yml +++ b/.github/workflows/check-outdated-trusted-root.yml @@ -7,6 +7,9 @@ on: jobs: check: runs-on: ubuntu-latest + permissions: + contents: read + issues: write steps: - uses: actions/checkout@v4 - name: Pull new trusted root From 31e23d80f0edd89bb6652147bbbeb69b0e47b82e Mon Sep 17 00:00:00 2001 From: James Titcumb Date: Tue, 6 May 2025 22:17:58 +0100 Subject: [PATCH 2/3] use labels for trusted root updates --- .github/workflows/check-outdated-trusted-root.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/check-outdated-trusted-root.yml b/.github/workflows/check-outdated-trusted-root.yml index 9d95171e..2c292436 100644 --- a/.github/workflows/check-outdated-trusted-root.yml +++ b/.github/workflows/check-outdated-trusted-root.yml @@ -21,7 +21,7 @@ jobs: diff resources/trusted-root.jsonl resources/new-trusted-root.jsonl \ && echo "Trusted root cert has not changed, no action required." \ || ( \ - (gh issue list | grep -i "Trusted root needs updating") \ + (gh issue list --label "trusted-root-update" | grep -i "Trusted root needs updating") \ && echo "Issue to update trusted root already exists, no action required." \ - || gh issue create --title "Trusted root needs updating" --body "The trusted root certificate file needs updating. Use the \`gh attestation trusted-root > resources/trusted-root.jsonl\` command to update it." --assignee "asgrim" \ + || gh issue create --title "Trusted root needs updating" --body "The trusted root certificate file needs updating. Use the \`gh attestation trusted-root > resources/trusted-root.jsonl\` command to update it." --assignee "asgrim" --label "trusted-root-update" \ ) From 20d325986f7ba16f0ff5dc3ab4b97d7a7d530a73 Mon Sep 17 00:00:00 2001 From: James Titcumb Date: Tue, 6 May 2025 22:30:39 +0100 Subject: [PATCH 3/3] Comment for permissions needed for creating issues --- .github/workflows/check-outdated-trusted-root.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/check-outdated-trusted-root.yml b/.github/workflows/check-outdated-trusted-root.yml index 2c292436..e103ccb9 100644 --- a/.github/workflows/check-outdated-trusted-root.yml +++ b/.github/workflows/check-outdated-trusted-root.yml @@ -4,12 +4,15 @@ on: schedule: - cron: "0 0 * * *" +permissions: + contents: read + jobs: check: runs-on: ubuntu-latest permissions: contents: read - issues: write + issues: write # This permission is needed to create the issue steps: - uses: actions/checkout@v4 - name: Pull new trusted root