Merge pull request #661 from crazy-max/zizmor-fixes

ci: restrict update-dist GitHub App token scope
2026-05-21 21:46:08 +08:00 · 2026-05-21 14:57:49 +02:00 · 2026-05-21 14:26:18 +02:00
2 changed files with 3 additions and 1 deletions
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -29,7 +29,7 @@ jobs:
          targets: test
      -
        name: Upload coverage
-        uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
+        uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6.0.0
        with:
          files: ./coverage/clover.xml
          token: ${{ secrets.CODECOV_TOKEN }}
--- a/.github/workflows/update-dist.yml
+++ b/.github/workflows/update-dist.yml
@@ -26,6 +26,8 @@ jobs:
          app-id: ${{ secrets.GHACTIONS_REPO_WRITE_APP_ID }}
          private-key: ${{ secrets.GHACTIONS_REPO_WRITE_APP_PRIVATE_KEY }}
          owner: docker
+          repositories: metadata-action
+          permission-contents: write
      -
        name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
Author	SHA1	Message	Date
CrazyMax	1b2e78b2f1	Merge pull request #661 from crazy-max/zizmor-fixes ci: restrict update-dist GitHub App token scope	2026-05-21 14:57:49 +02:00
CrazyMax	0569d83a01	ci: restrict update-dist GitHub App token scope Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>	2026-05-21 14:26:18 +02:00