From 2ec48939c7c7d62702124bba6b72b1f65497debe Mon Sep 17 00:00:00 2001 From: Martijn Govers Date: Thu, 23 Jul 2026 14:57:10 +0200 Subject: [PATCH 1/3] use restricted app token Signed-off-by: Martijn Govers --- .github/workflows/ci.yml | 1 + .github/workflows/refresh-lock-and-linter-dependencies.yml | 1 + 2 files changed, 2 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index f85fd170..75c2d655 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -84,6 +84,7 @@ jobs: with: client-id: ${{ secrets.RELEASE_BOT_APP_ID }} private-key: ${{ secrets.RELEASE_BOT_PRIVATE_KEY }} + repositories: ${{ github.repository }} - name: Create GitHub release uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2 diff --git a/.github/workflows/refresh-lock-and-linter-dependencies.yml b/.github/workflows/refresh-lock-and-linter-dependencies.yml index 808e8c77..34b9310b 100644 --- a/.github/workflows/refresh-lock-and-linter-dependencies.yml +++ b/.github/workflows/refresh-lock-and-linter-dependencies.yml @@ -86,6 +86,7 @@ jobs: with: app-id: ${{ secrets.CI_BOT_APP_ID }} private-key: ${{ secrets.CI_BOT_PRIVATE_KEY }} + repositories: ${{ github.repository }} - name: create pull request if: ${{ inputs.create-pr || github.event_name == 'schedule' }} From 77e2b22c6d38361abbe97ede343c3d946b0c5ed0 Mon Sep 17 00:00:00 2001 From: Martijn Govers Date: Thu, 23 Jul 2026 16:56:55 +0200 Subject: [PATCH 2/3] restrict permissions Signed-off-by: Martijn Govers --- .github/workflows/ci.yml | 1 + .github/workflows/refresh-lock-and-linter-dependencies.yml | 2 ++ 2 files changed, 3 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 75c2d655..c9f7c198 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -85,6 +85,7 @@ jobs: client-id: ${{ secrets.RELEASE_BOT_APP_ID }} private-key: ${{ secrets.RELEASE_BOT_PRIVATE_KEY }} repositories: ${{ github.repository }} + permissions-contents: write - name: Create GitHub release uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2 diff --git a/.github/workflows/refresh-lock-and-linter-dependencies.yml b/.github/workflows/refresh-lock-and-linter-dependencies.yml index 34b9310b..15c4af92 100644 --- a/.github/workflows/refresh-lock-and-linter-dependencies.yml +++ b/.github/workflows/refresh-lock-and-linter-dependencies.yml @@ -87,6 +87,8 @@ jobs: app-id: ${{ secrets.CI_BOT_APP_ID }} private-key: ${{ secrets.CI_BOT_PRIVATE_KEY }} repositories: ${{ github.repository }} + permissions-contents: write + permissions-pull-request: write - name: create pull request if: ${{ inputs.create-pr || github.event_name == 'schedule' }} From ee92e494a4b1e078a96bf722cf6f631649005f40 Mon Sep 17 00:00:00 2001 From: Martijn Govers Date: Fri, 24 Jul 2026 11:11:51 +0200 Subject: [PATCH 3/3] Apply suggestions from code review Signed-off-by: Martijn Govers Co-authored-by: Martijn Govers Signed-off-by: Martijn Govers --- .github/workflows/ci.yml | 2 +- .github/workflows/refresh-lock-and-linter-dependencies.yml | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index c9f7c198..e1afc260 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -85,7 +85,7 @@ jobs: client-id: ${{ secrets.RELEASE_BOT_APP_ID }} private-key: ${{ secrets.RELEASE_BOT_PRIVATE_KEY }} repositories: ${{ github.repository }} - permissions-contents: write + permission-contents: write - name: Create GitHub release uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2 diff --git a/.github/workflows/refresh-lock-and-linter-dependencies.yml b/.github/workflows/refresh-lock-and-linter-dependencies.yml index 15c4af92..81fad9c3 100644 --- a/.github/workflows/refresh-lock-and-linter-dependencies.yml +++ b/.github/workflows/refresh-lock-and-linter-dependencies.yml @@ -87,8 +87,8 @@ jobs: app-id: ${{ secrets.CI_BOT_APP_ID }} private-key: ${{ secrets.CI_BOT_PRIVATE_KEY }} repositories: ${{ github.repository }} - permissions-contents: write - permissions-pull-request: write + permission-contents: write + permission-pull-request: write - name: create pull request if: ${{ inputs.create-pr || github.event_name == 'schedule' }}