Merge pull request #1513 from messense/generate-ci-perm

Fine-grained GitHub Actions permission in `generate-ci`
PyO3 · Mar 3, 2023 · 25ed2cd · 25ed2cd
2 parents f790e8f + d80b4e5
commit 25ed2cd
Showing 1 changed file with 30 additions and 4 deletions.
diff --git a/src/ci.rs b/src/ci.rs
@@ -178,6 +178,9 @@ on:
   pull_request:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:\n",
             version = env!("CARGO_PKG_VERSION"),
         );
@@ -432,20 +435,31 @@ jobs:\n",
     runs-on: ubuntu-latest
     if: "startsWith(github.ref, 'refs/tags/')"
     needs: [{needs}]
-    steps:
+"#,
+            needs = needs.join(", ")
+        ));
+        if platforms.contains(&Platform::Emscripten) {
+            conf.push_str(
+                r#"    permissions:
+      # Used to upload release artifacts
+      contents: write
+"#,
+            );
+        }
+        conf.push_str(
+            r#"    steps:
       - uses: actions/download-artifact@v3
         with:
           name: wheels
       - name: Publish to PyPI
         uses: PyO3/maturin-action@v1
         env:
-          MATURIN_PYPI_TOKEN: ${{{{ secrets.PYPI_API_TOKEN }}}}
+          MATURIN_PYPI_TOKEN: ${{ secrets.PYPI_API_TOKEN }}
         with:
           command: upload
           args: --skip-existing *
 "#,
-            needs = needs.join(", ")
-        ));
+        );
         if platforms.contains(&Platform::Emscripten) {
             conf.push_str(
                 "      - uses: actions/download-artifact@v3
@@ -505,6 +519,9 @@ mod tests {
               pull_request:
               workflow_dispatch:
 
+            permissions:
+              contents: read
+
             jobs:
               linux:
                 runs-on: ubuntu-latest
@@ -629,6 +646,9 @@ mod tests {
               pull_request:
               workflow_dispatch:
 
+            permissions:
+              contents: read
+
             jobs:
               linux:
                 runs-on: ubuntu-latest
@@ -747,6 +767,9 @@ mod tests {
               pull_request:
               workflow_dispatch:
 
+            permissions:
+              contents: read
+
             jobs:
               linux:
                 runs-on: ubuntu-latest
@@ -910,6 +933,9 @@ mod tests {
               pull_request:
               workflow_dispatch:
 
+            permissions:
+              contents: read
+
             jobs:
               linux:
                 runs-on: ubuntu-latest