Commit 73de450
committed
tools: use the read-only token when filtering PRs in CQ
Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: #65169
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>1 parent f32a863 commit 73de450
1 file changed
Lines changed: 9 additions & 5 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -58,6 +58,8 @@ jobs: | |||
| 58 | 58 | commitQueue: | |
| 59 | 59 | needs: get_candidate_prs | |
| 60 | 60 | if: needs.get_candidate_prs.outputs.candidates != '' | |
| 61 | + permissions: | ||
| 62 | + pull-requests: read | ||
| 61 | 63 | runs-on: ubuntu-slim | |
| 62 | 64 | steps: | |
| 63 | 65 | # Install dependencies | |
@@ -78,13 +80,13 @@ jobs: | |||
| 78 | 80 | ncu-config --global set branch "${GITHUB_REF_NAME}" | |
| 79 | 81 | ncu-config --global set upstream origin | |
| 80 | 82 | ncu-config --global set username "$USERNAME" | |
| 81 | - ncu-config --global set token "$GITHUB_TOKEN" | ||
| 83 | + ncu-config --global set token "$GH_TOKEN" | ||
| 82 | 84 | ncu-config --global set jenkins_token "$JENKINS_TOKEN" | |
| 83 | 85 | ncu-config --global set repo "${REPOSITORY}" | |
| 84 | 86 | ncu-config --global set owner "${GITHUB_REPOSITORY_OWNER}" | |
| 85 | 87 | env: | |
| 86 | 88 | USERNAME: ${{ secrets.JENKINS_USER }} | |
| 87 | - GITHUB_TOKEN: ${{ secrets.GH_USER_TOKEN }} | ||
| 89 | + GH_TOKEN: ${{ github.token }} | ||
| 88 | 90 | JENKINS_TOKEN: ${{ secrets.JENKINS_TOKEN }} | |
| 89 | 91 | ||
| 90 | 92 | - name: Filter Pull Requests | |
@@ -154,7 +156,7 @@ jobs: | |||
| 154 | 156 | echo "numbers=$numbers" >> "$GITHUB_OUTPUT" | |
| 155 | 157 | env: | |
| 156 | 158 | CANDIDATES: ${{ needs.get_candidate_prs.outputs.candidates }} | |
| 157 | - GITHUB_TOKEN: ${{ secrets.GH_USER_TOKEN }} | ||
| 159 | + GH_TOKEN: ${{ github.token }} | ||
| 158 | 160 | ||
| 159 | 161 | - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| 160 | 162 | if: steps.get_mergeable_prs.outputs.numbers != '' | |
@@ -167,6 +169,8 @@ jobs: | |||
| 167 | 169 | ||
| 168 | 170 | - name: Start the Commit Queue | |
| 169 | 171 | if: steps.get_mergeable_prs.outputs.numbers != '' | |
| 170 | - run: ./tools/actions/commit-queue.sh "${GITHUB_REPOSITORY_OWNER}" "${REPOSITORY}" ${{ steps.get_mergeable_prs.outputs.numbers }} | ||
| 172 | + run: | | ||
| 173 | + ncu-config set token "$GH_TOKEN" | ||
| 174 | + ./tools/actions/commit-queue.sh "${GITHUB_REPOSITORY_OWNER}" "${REPOSITORY}" ${{ steps.get_mergeable_prs.outputs.numbers }} | ||
| 171 | 175 | env: | |
| 172 | - GITHUB_TOKEN: ${{ secrets.GH_USER_TOKEN }} | ||
| 176 | + GH_TOKEN: ${{ secrets.GH_USER_TOKEN }} | ||
0 commit comments