stride3d/stride
1
0
Fork 0
mirror of https://github.com/stride3d/stride.git synced 2026-10-12 02:23:23 +00:00
Code Issues Packages Projects Releases Wiki Activity

ci: enforce release-managers membership (fix no-op permission check)

Browse Source
This commit is contained in:
Virgile Bello
2026-06-30 12:35:45 +09:00
parent 97acd760d3
commit f5da08959a
4 changed files with 16 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/release-launcher.yml
+4 -3
View File
@@ -42,9 +42,10 @@ jobs:
ORG=$(echo "${{ github.repository }}" | cut -d/ -f1)
TEAM="stride-release-managers"
USER="${{ github.actor }}"
STATUS=$(gh api "orgs/$ORG/teams/$TEAM/memberships/$USER" --silent 2>&1 && echo "ok" || echo "fail")
if [ "$STATUS" = "fail" ]; then
echo "::error::User $USER is not a member of $ORG/$TEAM. Sign/deploy requires stride-release-managers team membership."
# A 404 here means either the actor isn't a member OR GH_PAT can't read the team
# (dead/under-scoped token); the message covers both since the API can't distinguish them.
if ! gh api "orgs/$ORG/teams/$TEAM/memberships/$USER" --silent 2>/dev/null; then
echo "::error::Sign/deploy blocked: '$USER' is not a member of $ORG/$TEAM, or GH_PAT cannot read it (dead token / missing Organization Members: Read). Requires stride-release-managers membership."
exit 1
fi
.github/workflows/release-unlist.yml
+4 -3
View File
@@ -24,9 +24,10 @@ jobs:
ORG=$(echo "${{ github.repository }}" | cut -d/ -f1)
TEAM="stride-release-managers"
USER="${{ github.actor }}"
STATUS=$(gh api "orgs/$ORG/teams/$TEAM/memberships/$USER" --silent 2>&1 && echo "ok" || echo "fail")
if [ "$STATUS" = "fail" ]; then
echo "::error::User $USER is not a member of $ORG/$TEAM. Unlisting requires stride-release-managers team membership."
# A 404 here means either the actor isn't a member OR GH_PAT can't read the team
# (dead/under-scoped token); the message covers both since the API can't distinguish them.
if ! gh api "orgs/$ORG/teams/$TEAM/memberships/$USER" --silent 2>/dev/null; then
echo "::error::Unlisting blocked: '$USER' is not a member of $ORG/$TEAM, or GH_PAT cannot read it (dead token / missing Organization Members: Read). Requires stride-release-managers membership."
exit 1
fi
.github/workflows/release-vspackage.yml
+4 -3
View File
@@ -39,9 +39,10 @@ jobs:
ORG=$(echo "${{ github.repository }}" | cut -d/ -f1)
TEAM="stride-release-managers"
USER="${{ github.actor }}"
STATUS=$(gh api "orgs/$ORG/teams/$TEAM/memberships/$USER" --silent 2>&1 && echo "ok" || echo "fail")
if [ "$STATUS" = "fail" ]; then
echo "::error::User $USER is not a member of $ORG/$TEAM. Sign/deploy requires stride-release-managers team membership."
# A 404 here means either the actor isn't a member OR GH_PAT can't read the team
# (dead/under-scoped token); the message covers both since the API can't distinguish them.
if ! gh api "orgs/$ORG/teams/$TEAM/memberships/$USER" --silent 2>/dev/null; then
echo "::error::Sign/deploy blocked: '$USER' is not a member of $ORG/$TEAM, or GH_PAT cannot read it (dead token / missing Organization Members: Read). Requires stride-release-managers membership."
exit 1
fi
.github/workflows/release.yml
+4 -3
View File
@@ -70,9 +70,10 @@ jobs:
ORG=$(echo "${{ github.repository }}" | cut -d/ -f1)
TEAM="stride-release-managers"
USER="${{ github.actor }}"
STATUS=$(gh api "orgs/$ORG/teams/$TEAM/memberships/$USER" --silent 2>&1 && echo "ok" || echo "fail")
if [ "$STATUS" = "fail" ]; then
echo "::error::User $USER is not a member of $ORG/$TEAM. Sign/deploy requires stride-release-managers team membership."
# A 404 here means either the actor isn't a member OR GH_PAT can't read the team
# (dead/under-scoped token); the message covers both since the API can't distinguish them.
if ! gh api "orgs/$ORG/teams/$TEAM/memberships/$USER" --silent 2>/dev/null; then
echo "::error::Sign/deploy blocked: '$USER' is not a member of $ORG/$TEAM, or GH_PAT cannot read it (dead token / missing Organization Members: Read). Requires stride-release-managers membership."
exit 1
fi