Skip to content

set permissions needed for releases #113

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
anikaweinmann merged 1 commit into from
Oct 8, 2026
Merged

set permissions needed for releases #113

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 11 additions & 11 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,10 +33,10 @@ jobs:

```

or use e.g. ` pylint-version: ''` to skip checks with pylint. (If one of
or use e.g. ` pylint-version: ''` to skip checks with pylint. (If one of
the versions is set to an empty string the code quality check will be skipped.)

Examples how `flake8`, `pylint`, `markdownlint`, `shellcheck` and `ruff` can be
Examples how `flake8`, `pylint`, `markdownlint`, `shellcheck` and `ruff` can be
configured are in the [linting-config-examples](linting-config-examples)
folder. The `pylint` and `ruff` configuration files do not need to be created if
they are not to be customized, since they will be copied by the workflow if they
Expand Down Expand Up @@ -165,8 +165,8 @@ on:
release:
types: [published]

# the workflow does not require permissions, but to avoid a code security warning this should be explicitly defined:
permissions: {}
permissions:
contents: write

jobs:
publish-python:
Expand Down Expand Up @@ -290,8 +290,9 @@ on:
jobs:
sbom-scan:
permissions:
contents: read
contents: write
security-events: write
actions: read

uses: mundialis/github-workflows/.github/workflows/sbom-vulnerability-scan.yml@main

Expand Down Expand Up @@ -372,11 +373,11 @@ Optional inputs:
notification recipient. In mundialis and actinia-org repositories, use
the organization variable `CYBERSECURITY_EMAIL`.

When Dependency-Track integration is enabled, the secret `dependency-track-api-key` must be
When Dependency-Track integration is enabled, the secret `dependency-track-api-key` must be
provided by the calling workflow.

When email notifications are enabled, `email-address` and the secret `smtp-password` must also
be provided. The mundialis and actinia-org organizations provide the following configuration
When email notifications are enabled, `email-address` and the secret `smtp-password` must also
be provided. The mundialis and actinia-org organizations provide the following configuration
for this purpose:

- `CYBERSECURITY_EMAIL` as an organization variable.
Expand Down Expand Up @@ -416,11 +417,10 @@ on:
release:
types: [published]

# the workflow does not require permissions, but to avoid a code security warning this should be explicitly defined:
permissions: {}

jobs:
generate-third-party-licenses:
permissions:
contents: write
uses: mundialis/github-workflows/.github/workflows/third-party-licenses.yml@main
with:
# dockerfile: docker/actinia-core-alpine/Dockerfile
Expand Down
Loading