From 8ac24cffaf4a7f54c4e82bcc1eba887afdcbb437 Mon Sep 17 00:00:00 2001 From: jrfnl Date: Fri, 16 Oct 2026 02:04:12 +0200 Subject: [PATCH] GH Actions/`update-website`: move permissions to job level ... to apply the most minimal permissions possible in the right places. Also see 44 --- .github/workflows/update-website.yml | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/.github/workflows/update-website.yml b/.github/workflows/update-website.yml index 0a58ffd..a9ca069 100644 --- a/.github/workflows/update-website.yml +++ b/.github/workflows/update-website.yml @@ -14,20 +14,20 @@ on: types: - 'phpcs-release' -# Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages -permissions: - contents: write - pages: write - id-token: write - # Allow only one concurrent deployment, skipping runs queued between the run in-progress and latest queued. # However, do NOT cancel in-progress runs as we want to allow these production deployments to complete. concurrency: group: "pages" cancel-in-progress: false +# Permissions should be configured at the job level. +permissions: {} + jobs: update: + permissions: + contents: write # To clone the repo and to commit the changes. + # Don't run on forks. if: github.repository == 'PHPCSStandards/schema.phpcodesniffer.com' @@ -101,6 +101,10 @@ jobs: path: _site/ deploy: + permissions: + pages: write # To deploy to Pages. + id-token: write # To verify the deployment originates from an appropriate source. + needs: update # Don't run on forks.