mirror of
https://github.com/HeyPuter/puter.git
synced 2026-11-13 18:34:51 -10:00
Thibaud-VdbandDaniel Salazar
1abd25eb31
* ci: take release-please from its current home google-github-actions/release-please-action is archived: the action moved to googleapis/release-please-action, same code, same inputs, same major version, and that is where the fixes now land. The release-please workflow references the maintained repository. * ci: declare what the three unscoped workflows may do with the token Docs Build, Maintain Release Merge PR and Notify HeyPuter had no permissions block, so they ran with the repository's default token scope. Docs Build only checks out and builds, Notify HeyPuter only calls the dispatch endpoint with its own token: both declare contents: read. Maintain Release Merge PR pushes the auto-update/release branch and opens the release pull request, so it declares contents: write and pull-requests: write. The other workflows already declared their scopes and are left as they are. * ci: stop persisting the checkout credentials in the jobs that never push actions/checkout keeps the job token in the clone's git config, where every later step can read it. Twelve checkouts now set persist-credentials: false: the backend and puter.js test jobs, the coverage jobs, the type checks, the docs build, the AI provider tests and the Docker image build read the clone and push nothing with git. The two checkouts of Maintain Release Merge PR keep the token: that job resets the release branch and pushes it through create-pull-request. * ci: lock the workflow actions to the commits they resolve to GitHub's workflow dependency lockfile holds the commit each action reference resolves to, transitive actions included, and the runner uses those commits even if a tag moves later. .github/workflows/actions.lock comes from gh actions-lock (v0.4.1), which also narrowed every reference to the exact release it locked, so Dependabot keeps bumping versions and its security alerts keep matching. Re-run the same command after adding or bumping an action. * ci: drop the unused token scope from Notify HeyPuter, match workflow indentation * ci: remove the disabled release workflows release-please and Maintain Release Merge PR have been disabled since 2024; releases are cut from calver tags. Their entries leave the lockfile with them. --------- Co-authored-by: Daniel Salazar <[email protected]>