mirror of
https://github.com/ivuorinen/dotfiles.git
synced 2026-02-08 07:50:53 +00:00
Ismo Vuorinen
89aeb29c04
Replace read-all/write-all with minimum required permission scopes across all GitHub Actions workflows to follow the principle of least privilege (SonarCloud rule githubactions:S8234).
51 lines
1.5 KiB
YAML
51 lines
1.5 KiB
YAML
---
|
|
# $schema: "https://json.schemastore.org/github-workflow.json"
|
|
name: Release Daily State
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
schedule:
|
|
- cron: '0 21 * * *' # 00:00 at Europe/Helsinki
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
new-daily-release:
|
|
runs-on: ubuntu-latest
|
|
|
|
permissions:
|
|
contents: write
|
|
|
|
outputs:
|
|
created: ${{ steps.daily-version.outputs.created }}
|
|
version: ${{ steps.daily-version.outputs.version }}
|
|
|
|
steps:
|
|
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
|
|
- name: Create tag if necessary
|
|
uses: fregante/daily-version-action@fb1a60b7c4daf1410cd755e360ebec3901e58588 # v2.1.3
|
|
id: daily-version
|
|
|
|
- name: Create changelog text
|
|
if: steps.daily-version.outputs.created
|
|
id: changelog
|
|
uses: loopwerk/tag-changelog@941366edb8920e2071eae0449031830984b9f26e # v1.3.0
|
|
with:
|
|
token: ${{ secrets.GITHUB_TOKEN }}
|
|
config_file: .github/tag-changelog-config.js
|
|
|
|
- name: Create release
|
|
if: steps.daily-version.outputs.created
|
|
uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2.5.0
|
|
with:
|
|
token: ${{ secrets.GITHUB_TOKEN }}
|
|
tag_name: ${{ steps.daily-version.outputs.version }}
|
|
name: Release ${{ steps.daily-version.outputs.version }}
|
|
body: ${{ steps.changelog.outputs.changes }}
|