mirror of
https://github.com/AdguardTeam/dnsproxy.git
synced 2026-10-12 02:01:26 +00:00
Pull request: ADG-12053-imp-gh-workflow-permissions
Merge in GO/dnsproxy from ADG-12053-imp-gh-workflow-permissions to master Squashed commit of the following: commit 8ca6a84468a1bd35015ad4d9c090319251f96e61 Author: Dimitry Kolyshev <[email protected]> Date: Mon Apr 20 12:36:42 2026 +0700 gh workflows: imp commit daa912b16e104b5ba3de6365f841547ed69640e0 Author: Dimitry Kolyshev <[email protected]> Date: Mon Apr 20 12:14:13 2026 +0700 gh workflows: upd checkout commit 2e31af2e0e1ab57a24b10085006d00ff55c90618 Author: Dimitry Kolyshev <[email protected]> Date: Mon Apr 20 12:12:45 2026 +0700 gh workflows: fix build commit 82a479cb131dda69c27cfbcd995b3f7fb9ef04ab Author: Dimitry Kolyshev <[email protected]> Date: Mon Apr 20 12:03:56 2026 +0700 gh workflows: fix lint commit a47e6ae759d3cd30c5ca1693ea7cd7dff0faa8cf Author: Dimitry Kolyshev <[email protected]> Date: Mon Apr 20 11:59:19 2026 +0700 gh workflows: fmt commit 29471acc307861aafa74dd4158b987a8f035aa5f Author: Dimitry Kolyshev <[email protected]> Date: Mon Apr 20 11:55:38 2026 +0700 gh workflows: imp permissions
This commit is contained in:
Dimitry Kolyshev
@@ -1,8 +1,12 @@
|
||||
name: Build
|
||||
|
||||
# Permissions are disabled for all the jobs by default, and then overridden for
|
||||
# specific jobs if needed. This is a recommended practice for security reasons,
|
||||
# and also allows to avoid mistakes with permissions when creating new jobs.
|
||||
#
|
||||
# See https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#permissions.
|
||||
'permissions': {}
|
||||
'env':
|
||||
'GO_VERSION': '1.26.1'
|
||||
|
||||
'on':
|
||||
'push':
|
||||
'tags':
|
||||
@@ -10,9 +14,10 @@ name: Build
|
||||
'branches':
|
||||
- '*'
|
||||
'pull_request':
|
||||
|
||||
jobs:
|
||||
tests:
|
||||
'permissions':
|
||||
'contents': 'read'
|
||||
runs-on: ${{ matrix.os }}
|
||||
strategy:
|
||||
matrix:
|
||||
@@ -21,7 +26,12 @@ jobs:
|
||||
- macos-latest
|
||||
- ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@master
|
||||
- 'uses': 'actions/checkout@v6'
|
||||
'with':
|
||||
# Set to false to avoid GITHUB_TOKEN leaking.
|
||||
#
|
||||
# See https://github.com/actions/checkout/issues/485#issuecomment-934422611.
|
||||
'persist-credentials': false
|
||||
- uses: actions/setup-go@v2
|
||||
with:
|
||||
go-version: '${{ env.GO_VERSION }}'
|
||||
@@ -36,13 +46,20 @@ jobs:
|
||||
with:
|
||||
token: ${{ secrets.CODECOV_TOKEN }}
|
||||
file: ./coverage.txt
|
||||
|
||||
build:
|
||||
needs:
|
||||
- tests
|
||||
'permissions':
|
||||
# Required by actions/create-release.
|
||||
'contents': 'write'
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@master
|
||||
- 'uses': 'actions/checkout@v6'
|
||||
'with':
|
||||
# Set to false to avoid GITHUB_TOKEN leaking.
|
||||
#
|
||||
# See https://github.com/actions/checkout/issues/485#issuecomment-934422611.
|
||||
'persist-credentials': false
|
||||
- uses: actions/setup-go@v2
|
||||
with:
|
||||
go-version: '${{ env.GO_VERSION }}'
|
||||
@@ -77,17 +94,20 @@ jobs:
|
||||
file: "build/dnsproxy-*.tar.gz;build/dnsproxy-*.zip"
|
||||
tags: true
|
||||
draft: false
|
||||
|
||||
notify:
|
||||
needs:
|
||||
- build
|
||||
if:
|
||||
if: |
|
||||
${{ always() &&
|
||||
(
|
||||
github.event_name == 'push' ||
|
||||
github.event.pull_request.head.repo.full_name == github.repository
|
||||
)
|
||||
}}
|
||||
'permissions':
|
||||
# Required by workflow-conclusion-action to check workflow status.
|
||||
'actions': 'read'
|
||||
'contents': 'read'
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Conclusion
|
||||
|
||||
@@ -1,8 +1,12 @@
|
||||
'name': Docker
|
||||
|
||||
# Permissions are disabled for all the jobs by default, and then overridden for
|
||||
# specific jobs if needed. This is a recommended practice for security reasons,
|
||||
# and also allows to avoid mistakes with permissions when creating new jobs.
|
||||
#
|
||||
# See https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#permissions.
|
||||
'permissions': {}
|
||||
'env':
|
||||
'GO_VERSION': '1.26.1'
|
||||
|
||||
'on':
|
||||
'push':
|
||||
'tags':
|
||||
@@ -10,15 +14,19 @@
|
||||
# Builds from the master branch will be pushed with the `dev` tag.
|
||||
'branches':
|
||||
- 'master'
|
||||
|
||||
'jobs':
|
||||
'docker':
|
||||
'permissions':
|
||||
'contents': 'read'
|
||||
'runs-on': 'ubuntu-latest'
|
||||
'steps':
|
||||
- 'name': 'Checkout'
|
||||
'uses': 'actions/checkout@v3'
|
||||
'uses': 'actions/checkout@v6'
|
||||
'with':
|
||||
'fetch-depth': 0
|
||||
# Set to false to avoid GITHUB_TOKEN leaking.
|
||||
#
|
||||
# See https://github.com/actions/checkout/issues/485#issuecomment-934422611.
|
||||
'persist-credentials': false
|
||||
- 'name': 'Set up Go'
|
||||
'uses': 'actions/setup-go@v3'
|
||||
'with':
|
||||
@@ -56,17 +64,20 @@
|
||||
DOCKER_PUSH="1" \
|
||||
VERBOSE="1" \
|
||||
docker
|
||||
|
||||
'notify':
|
||||
'needs':
|
||||
- 'docker'
|
||||
'if':
|
||||
'if': |
|
||||
${{ always() &&
|
||||
(
|
||||
github.event_name == 'push' ||
|
||||
github.event.pull_request.head.repo.full_name == github.repository
|
||||
)
|
||||
(
|
||||
github.event_name == 'push' ||
|
||||
github.event.pull_request.head.repo.full_name == github.repository
|
||||
)
|
||||
}}
|
||||
'permissions':
|
||||
# Required by workflow-conclusion-action to check workflow status.
|
||||
'actions': 'read'
|
||||
'contents': 'read'
|
||||
'runs-on': ubuntu-latest
|
||||
'steps':
|
||||
- 'name': Conclusion
|
||||
|
||||
+27
-14
@@ -1,8 +1,12 @@
|
||||
'name': 'lint'
|
||||
|
||||
# Permissions are disabled for all the jobs by default, and then overridden for
|
||||
# specific jobs if needed. This is a recommended practice for security reasons,
|
||||
# and also allows to avoid mistakes with permissions when creating new jobs.
|
||||
#
|
||||
# See https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#permissions.
|
||||
'permissions': {}
|
||||
'env':
|
||||
'GO_VERSION': '1.26.1'
|
||||
|
||||
'on':
|
||||
'push':
|
||||
'tags':
|
||||
@@ -10,36 +14,45 @@
|
||||
'branches':
|
||||
- '*'
|
||||
'pull_request':
|
||||
|
||||
'jobs':
|
||||
'go-lint':
|
||||
'permissions':
|
||||
'contents': 'read'
|
||||
'runs-on': 'ubuntu-latest'
|
||||
'steps':
|
||||
- 'uses': 'actions/checkout@v2'
|
||||
- 'uses': 'actions/checkout@v6'
|
||||
'with':
|
||||
# Set to false to avoid GITHUB_TOKEN leaking.
|
||||
#
|
||||
# See https://github.com/actions/checkout/issues/485#issuecomment-934422611.
|
||||
'persist-credentials': false
|
||||
- 'name': 'Set up Go'
|
||||
'uses': 'actions/setup-go@v3'
|
||||
'with':
|
||||
'go-version': '${{ env.GO_VERSION }}'
|
||||
- 'name': 'run-lint'
|
||||
'run': >
|
||||
make go-deps go-lint
|
||||
|
||||
'run': 'make go-deps go-lint'
|
||||
'notify':
|
||||
'needs':
|
||||
- 'go-lint'
|
||||
# Secrets are not passed to workflows that are triggered by a pull request
|
||||
# from a fork.
|
||||
#
|
||||
# Use always() to signal to the runner that this job must run even if the
|
||||
# previous ones failed.
|
||||
'if':
|
||||
'if': |
|
||||
${{
|
||||
always() &&
|
||||
github.repository_owner == 'AdguardTeam' &&
|
||||
(
|
||||
github.event_name == 'push' ||
|
||||
github.event.pull_request.head.repo.full_name == github.repository
|
||||
)
|
||||
always() &&
|
||||
github.repository_owner == 'AdguardTeam' &&
|
||||
(
|
||||
github.event_name == 'push' ||
|
||||
github.event.pull_request.head.repo.full_name == github.repository
|
||||
)
|
||||
}}
|
||||
'permissions':
|
||||
# Required by workflow-conclusion-action to check workflow status.
|
||||
'actions': 'read'
|
||||
'contents': 'read'
|
||||
'runs-on': 'ubuntu-latest'
|
||||
'steps':
|
||||
- 'name': 'Conclusion'
|
||||
|
||||
Reference in New Issue
Block a user