chore(ci): Further harden workflows

VorpalBlade · Nov 3, 2024 · ca5fcc9 · ca5fcc9
1 parent 9534d99
commit ca5fcc9
Show file tree

Hide file tree

Showing 2 changed files with 19 additions and 12 deletions.
diff --git a/.github/workflows/act_build_release.yml b/.github/workflows/act_build_release.yml
@@ -1,10 +1,5 @@
 name: Release (helper)
 
-permissions:
-  attestations: write
-  contents: write
-  id-token: write
-
 on:
   workflow_call:
     inputs:
@@ -48,6 +43,8 @@ defaults:
 jobs:
   cargo-about:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     steps:
     - uses: actions/checkout@v4
       with:
@@ -69,6 +66,10 @@ jobs:
   upload:
     name: "Upload ${{ inputs.project }}: ${{ matrix.target }}"
     runs-on: ubuntu-latest
+    permissions:
+      attestations: write
+      contents: write
+      id-token: write
     strategy:
       matrix:
         include:
@@ -122,12 +123,15 @@ jobs:
         with:
           persist-credentials: false
       - name: Get AUR repo
-        run: git clone https://aur.archlinux.org/${{ inputs.project }}.git aur
+        run: git clone "https://aur.archlinux.org/${PROJECT}.git" aur
+        env:
+          PROJECT: ${{ inputs.project }}
       - name: Update PKGBUILD
         run: |
-          sed -i '/^_pkgver/s/=.*$/='${RELEASE_TAG#refs/tags/${{ inputs.project }}-v}'/' "aur/PKGBUILD"
+          sed -i '/^_pkgver/s/=.*$/='${RELEASE_TAG#refs/tags/${PROJECT}-v}'/' "aur/PKGBUILD"
           sed -i '/^pkgrel/s/=.*$/=1/' "aur/PKGBUILD"
         env:
+          PROJECT: ${{ inputs.project }}
           RELEASE_TAG: ${{ github.ref }}
       - name: Publish AUR package
         uses: KSXGitHub/github-actions-deploy-aur@v3.0.1

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -1,10 +1,5 @@
 name: Release
 
-permissions:
-  attestations: write
-  contents: write
-  id-token: write
-
 on:
   release:
     types: [published]
@@ -21,6 +16,10 @@ jobs:
 
   paketkoll:
     name: "Release paketkoll"
+    permissions:
+      attestations: write
+      contents: write
+      id-token: write
     if: github.repository_owner == 'VorpalBlade' && startsWith(github.event.release.name, 'paketkoll-v')
     uses: ./.github/workflows/act_build_release.yml
     with:
@@ -35,6 +34,10 @@ jobs:
 
   konfigkoll:
     name: "Release konfigkoll"
+    permissions:
+      attestations: write
+      contents: write
+      id-token: write
     if: github.repository_owner == 'VorpalBlade' && startsWith(github.event.release.name, 'konfigkoll-v')
     uses: ./.github/workflows/act_build_release.yml
     with: