ci: change permissions on auto-labeler

limit permissions to just pull-requests: write, not conent: write. I'm hoping this will limit the ability for the auto-labeler workflow from creating a draft release change image-name from hard-coded to github.repository Signed-off-by: jmeridth <[email protected]>
github · Jan 25, 2025 · 9465bed · 9465bed
1 parent c180b53
commit 9465bed
Show file tree

Hide file tree

Showing 3 changed files with 1 addition and 3 deletions.
diff --git a/.github/workflows/auto-labeler.yaml b/.github/workflows/auto-labeler.yaml
@@ -14,7 +14,6 @@ permissions:
 jobs:
   main:
     permissions:
-      contents: write
       pull-requests: write
     name: Auto label pull requests
     runs-on: ubuntu-latest

diff --git a/.github/workflows/test-auto-labeler.yaml b/.github/workflows/test-auto-labeler.yaml
@@ -9,7 +9,6 @@ permissions:
 jobs:
   auto_labeler:
     permissions:
-      contents: write
       pull-requests: write
     uses: ./.github/workflows/auto-labeler.yaml
     with:

diff --git a/.github/workflows/test-release.yaml b/.github/workflows/test-release.yaml
@@ -26,7 +26,7 @@ jobs:
       attestations: write
     uses: ./.github/workflows/release-image.yaml
     with:
-      image-name: github/ospo-reusable-workflows
+      image-name: ${{ github.repository }}
       full-tag: ${{ needs.release.outputs.full-tag }}
       short-tag: ${{ needs.release.outputs.short-tag }}
       create-attestation: true