Skip to content

Upload release assets #11566

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
frenck merged 7 commits into from
Mar 21, 2022
Merged

Upload release assets #11566

Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
f129145
Upload release assets
cdce8p Feb 5, 2022
05746f1
Update .github/workflows/release.yaml
cdce8p Feb 7, 2022
0a70d03
Remove unnecessary checkout step
cdce8p Feb 7, 2022
416a31f
Use helper action for asset upload
cdce8p Feb 15, 2022
8adc7d4
Use softprops/action-gh-release action
cdce8p Mar 17, 2022
5b91d0b
Code review
cdce8p Mar 17, 2022
31cc0a1
Set default workflow permissions
cdce8p Mar 18, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 15 additions & 0 deletions .github/workflows/release.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,10 +10,18 @@ env:
NODE_VERSION: 14
NODE_OPTIONS: --max_old_space_size=6144

# Set default workflow permissions
# All scopes not mentioned here are set to no access
# https://docs.github.com/en/actions/security-guides/automatic-token-authentication#permissions-for-the-github_token
permissions:
actions: none

jobs:
release:
name: Release
runs-on: ubuntu-latest
permissions:
contents: write # Required to upload release assets
Comment on lines +23 to +24
Copy link
Copy Markdown
Member

@ludeeus ludeeus Mar 17, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
permissions:
contents: write # Required to upload release assets

It already have this?
https://github.com/home-assistant/frontend/runs/5578172811?check_suite_focus=true#step:1:16

Copy link
Copy Markdown
Member Author

@cdce8p cdce8p Mar 17, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's recommended to limit the permissions to what's necessary.
https://docs.github.com/en/actions/security-guides/automatic-token-authentication#modifying-the-permissions-for-the-github_token

As a good security practice, you should grant the GITHUB_TOKEN the least required access.

By adding only contents: write explicitly, I exclude all other permission scopes.

Copy link
Copy Markdown
Member

@ludeeus ludeeus Mar 18, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If that is the reason behind it, it should be defined on the workflow as read, and then open each job to what they need.

Copy link
Copy Markdown
Member Author

@cdce8p cdce8p Mar 18, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

31cc0a1 I checked the other jobs. None need additional permissions.
I wasn't sure about artifact upload / download, but after testing it seems to work just fine.

For the future, it might be worth considering to limit the default repo1 / org2 permissions for Github tokens.
With regards to the other workflows, only a few would need explicit permissions.

  • release-drafter -> contents: write to create pre-releases
  • lock3 and stale4 -> issues: write and pull-requests: write

Footnotes

  1. https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository ↩

  2. https://docs.github.com/en/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#setting-the-permissions-of-the-github_token-for-your-organization ↩

  3. https://github.com/dessant/lock-threads#examples ↩

  4. https://github.com/actions/stale#recommended-permissions ↩

Copy link
Copy Markdown
Member

@ludeeus ludeeus Mar 21, 2022 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Uploading action artifacts needed "deployment" before, but if it works without anything that's just great 👍
As for changing the default of the entire org, I 100% agree with that, both in regards to the token, and potentially implementing an allow list for approved actions.

steps:
- name: Checkout the repository
uses: actions/checkout@v2
Expand Down Expand Up @@ -47,6 +55,13 @@ jobs:

script/release

- name: Upload release assets
uses: softprops/action-gh-release@v0.1.14
with:
files: |
dist/*.whl
dist/*.tar.gz

wheels-init:
name: Init wheels build
needs: release
Expand Down