diff options
Diffstat (limited to '.github/workflows')
| -rw-r--r-- | .github/workflows/ci.yml | 18 |
1 files changed, 12 insertions, 6 deletions
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index b595609..305df3c 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -4,6 +4,8 @@ on: push: workflow_dispatch: +permissions: {} + jobs: lint: runs-on: ubuntu-latest @@ -12,6 +14,8 @@ jobs: steps: - name: Checkout uses: actions/checkout@v7 + with: + persist-credentials: false - name: Set up Python uses: actions/setup-python@v7 with: @@ -31,16 +35,17 @@ jobs: - '3.14' - '3.x' runs-on: ubuntu-latest - name: 'Python ${{ matrix.python-version }}' + name: Python ${{ matrix.python-version }} steps: - name: Checkout uses: actions/checkout@v7 with: + persist-credentials: false submodules: recursive - name: Set up Python uses: actions/setup-python@v7 with: - python-version: '${{ matrix.python-version }}' + python-version: ${{ matrix.python-version }} - name: Run tests as root run: sudo ./test/runner/harness - name: Run tests @@ -57,9 +62,8 @@ jobs: && !startsWith(github.ref, 'refs/tags/debian/') container: image: archlinux:base-devel - env: - SSH_KEY: | - ${{ secrets.SSH_KEY }} + permissions: + contents: write steps: # This step must be done before actions/checkout. From the latter's # output: @@ -72,9 +76,11 @@ jobs: - name: Checkout uses: actions/checkout@v7 with: + persist-credentials: true ref: aur submodules: recursive - token: '${{ secrets.GH_TOKEN }}' - name: Run maintenance + env: + SSH_KEY: ${{ secrets.SSH_KEY }} run: | make -C "$GITHUB_WORKSPACE" ci |