Polish gh-11367

This commit is contained in:
Steve Riesenberg 2022-07-26 15:31:10 -05:00
parent 8c634f8a9d
commit 6ad567f0fa
No known key found for this signature in database
GPG Key ID: 5F311AB48A55D521
5 changed files with 29 additions and 5 deletions

View File

@ -8,9 +8,15 @@ on:
push: push:
branches: branches:
- '*.x' - '*.x'
permissions:
contents: read
jobs: jobs:
build: build:
runs-on: ubuntu-latest runs-on: ubuntu-latest
permissions:
contents: read
issues: write
pull-requests: write
steps: steps:
- uses: actions/checkout@v3 - uses: actions/checkout@v3
- uses: actions/setup-java@v3 - uses: actions/setup-java@v3

View File

@ -8,9 +8,9 @@ permissions:
jobs: jobs:
main: main:
runs-on: ubuntu-latest
permissions: permissions:
contents: none contents: none
runs-on: ubuntu-latest
steps: steps:
- name: Delete artifacts in cron job - name: Delete artifacts in cron job
env: env:

View File

@ -20,6 +20,9 @@ env:
ARTIFACTORY_PASSWORD: ${{ secrets.ARTIFACTORY_PASSWORD }} ARTIFACTORY_PASSWORD: ${{ secrets.ARTIFACTORY_PASSWORD }}
RUN_JOBS: ${{ github.repository == 'spring-projects/spring-security' }} RUN_JOBS: ${{ github.repository == 'spring-projects/spring-security' }}
permissions:
contents: read
jobs: jobs:
prerequisites: prerequisites:
name: Pre-requisites for building name: Pre-requisites for building
@ -232,11 +235,11 @@ jobs:
DOCS_SSH_KEY: ${{ secrets.DOCS_SSH_KEY }} DOCS_SSH_KEY: ${{ secrets.DOCS_SSH_KEY }}
DOCS_HOST: ${{ secrets.DOCS_HOST }} DOCS_HOST: ${{ secrets.DOCS_HOST }}
perform_release: perform_release:
permissions:
contents: write # for Git to git push
name: Perform release name: Perform release
needs: [prerequisites, deploy_artifacts, deploy_docs, deploy_schema] needs: [prerequisites, deploy_artifacts, deploy_docs, deploy_schema]
runs-on: ubuntu-latest runs-on: ubuntu-latest
permissions:
contents: write
timeout-minutes: 90 timeout-minutes: 90
if: ${{ !endsWith(needs.prerequisites.outputs.project_version, '-SNAPSHOT') }} if: ${{ !endsWith(needs.prerequisites.outputs.project_version, '-SNAPSHOT') }}
env: env:
@ -325,6 +328,9 @@ jobs:
name: Perform post-release name: Perform post-release
needs: [prerequisites, deploy_artifacts, deploy_docs, deploy_schema] needs: [prerequisites, deploy_artifacts, deploy_docs, deploy_schema]
runs-on: ubuntu-latest runs-on: ubuntu-latest
permissions:
contents: read
issues: write
timeout-minutes: 90 timeout-minutes: 90
if: ${{ endsWith(needs.prerequisites.outputs.project_version, '-SNAPSHOT') }} if: ${{ endsWith(needs.prerequisites.outputs.project_version, '-SNAPSHOT') }}
env: env:
@ -343,6 +349,8 @@ jobs:
needs: [build_jdk_11, snapshot_tests, check_samples, check_tangles, deploy_artifacts, deploy_docs, deploy_schema, perform_release, perform_post_release] needs: [build_jdk_11, snapshot_tests, check_samples, check_tangles, deploy_artifacts, deploy_docs, deploy_schema, perform_release, perform_post_release]
if: failure() if: failure()
runs-on: ubuntu-latest runs-on: ubuntu-latest
permissions:
actions: read
steps: steps:
- name: Send Slack message - name: Send Slack message
# Workaround while waiting for Gamesight/slack-workflow-status#38 to be fixed # Workaround while waiting for Gamesight/slack-workflow-status#38 to be fixed

View File

@ -5,12 +5,14 @@ on:
env: env:
DUE_ON: ${{ github.event.milestone.due_on }} DUE_ON: ${{ github.event.milestone.due_on }}
TITLE: ${{ github.event.milestone.title }} TITLE: ${{ github.event.milestone.title }}
permissions:
contents: read
jobs: jobs:
spring-releasetrain-checks: spring-releasetrain-checks:
permissions:
contents: none
name: Check DueOn is on a Release Date name: Check DueOn is on a Release Date
runs-on: ubuntu-latest runs-on: ubuntu-latest
permissions:
contents: none
steps: steps:
- name: Print Milestone Being Checked - name: Print Milestone Being Checked
run: echo "Validating DueOn '$DUE_ON' for milestone '$TITLE'" run: echo "Validating DueOn '$DUE_ON' for milestone '$TITLE'"
@ -25,6 +27,8 @@ jobs:
needs: [spring-releasetrain-checks] needs: [spring-releasetrain-checks]
if: failure() if: failure()
runs-on: ubuntu-latest runs-on: ubuntu-latest
permissions:
actions: read
steps: steps:
- name: Send Slack message - name: Send Slack message
uses: Gamesight/slack-workflow-status@v1.0.1 uses: Gamesight/slack-workflow-status@v1.0.1

View File

@ -9,11 +9,17 @@ env:
GRADLE_ENTERPRISE_CACHE_PASSWORD: ${{ secrets.GRADLE_ENTERPRISE_CACHE_PASSWORD }} GRADLE_ENTERPRISE_CACHE_PASSWORD: ${{ secrets.GRADLE_ENTERPRISE_CACHE_PASSWORD }}
GRADLE_ENTERPRISE_SECRET_ACCESS_KEY: ${{ secrets.GRADLE_ENTERPRISE_SECRET_ACCESS_KEY }} GRADLE_ENTERPRISE_SECRET_ACCESS_KEY: ${{ secrets.GRADLE_ENTERPRISE_SECRET_ACCESS_KEY }}
permissions:
contents: read
jobs: jobs:
update_scheduled_release_version: update_scheduled_release_version:
name: Initiate Release If Scheduled name: Initiate Release If Scheduled
if: ${{ github.repository == 'spring-projects/spring-security' }} if: ${{ github.repository == 'spring-projects/spring-security' }}
runs-on: ubuntu-latest runs-on: ubuntu-latest
permissions:
contents: read
actions: read
steps: steps:
- id: checkout-source - id: checkout-source
name: Checkout Source Code name: Checkout Source Code