FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

Default GHA permissions to `contents: read` by hugovk · Pull Request #148346 · python/cpython · GitHub

  1. python
  2. cpython

Repository navigation

Default GHA permissions to contents: read - #148346

Merged
hugovk merged 2 commits into
python:mainfrom
hugovk:3.15-gha-contents-read
Apr 11, 2026
ConversationCommits (2)ChecksFiles changed
Merged

Default GHA permissions to contents: read#148346
hugovk merged 2 commits into
python:mainfrom
hugovk:3.15-gha-contents-read

Conversation

hugovk commented Apr 10, 2026

Copy link
Copy Markdown
Member

Follow on from #148114, so GitHub Actions can run in private forks:

#148114 (comment)

hugovk added needs backport to 3.10 needs backport to 3.11 only security fixes needs backport to 3.12 only security fixes needs backport to 3.13 only security fixes needs backport to 3.14 bugs and security fixes labels Apr 10, 2026
hugovk added skip issue skip news infra CI, GitHub Actions, buildbots, Dependabot, etc. labels Apr 10, 2026
hugovk mentioned this pull request Apr 10, 2026
Merged

hugovk commented Apr 10, 2026

Copy link
Copy Markdown
Member Author

build.yml failed in my fork:

Invalid workflow file: .github/workflows/build.yml#L608 The workflow is not valid. .github/workflows/build.yml (Line: 608, Col: 3): Error calling workflow 'hugovk/cpython/.github/workflows/reusable-cifuzz.yml@a959dde4ca2a991f711a79b2c94f0cf2bf127b0a'. The workflow is requesting 'contents: read', but is only allowed 'contents: none'.

https://github.com/hugovk/cpython/actions/runs/24252340106

I think this will pass when merged, because it won't have the mismatch between main and the branch?

webknjaz commented Apr 10, 2026

Copy link
Copy Markdown
Member

@hugovk you may want to adjust line 616

hugovk commented Apr 10, 2026

Copy link
Copy Markdown
Member Author

@webknjaz This one?

https://github.com/hugovk/cpython/blob/a959dde4ca2a991f711a79b2c94f0cf2bf127b0a/.github/workflows/build.yml#L616

Adjust how?

webknjaz commented Apr 10, 2026

Copy link
Copy Markdown
Member

Yep, add contents: read there. The calling workflow sets contents: none but the reusable one wants higher privileges, which is what that error is about.

hugovk commented Apr 11, 2026

Copy link
Copy Markdown
Member Author

Thanks, better now: https://github.com/hugovk/cpython/actions/runs/24280156057?pr=148346

hugovk merged commit 9c9df8a into python:main Apr 11, 2026
91 checks passed
hugovk deleted the 3.15-gha-contents-read branch April 11, 2026 15:37

miss-islington-app Bot commented Apr 11, 2026

Copy link
Copy Markdown

Thanks @hugovk for the PR 🌮🎉.. I'm working now to backport this PR to: 3.10, 3.11, 3.12, 3.13, 3.14.
🐍🍒⛏🤖

miss-islington-app Bot commented Apr 11, 2026

Copy link
Copy Markdown

Sorry, @hugovk, I could not cleanly backport this to 3.14 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 9c9df8ac8cbb8f539b3f342d01e40b7a0a57dcbf 3.14

miss-islington-app Bot commented Apr 11, 2026

Copy link
Copy Markdown

Sorry, @hugovk, I could not cleanly backport this to 3.13 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 9c9df8ac8cbb8f539b3f342d01e40b7a0a57dcbf 3.13

miss-islington-app Bot commented Apr 11, 2026

Copy link
Copy Markdown

Sorry, @hugovk, I could not cleanly backport this to 3.12 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 9c9df8ac8cbb8f539b3f342d01e40b7a0a57dcbf 3.12

miss-islington-app Bot commented Apr 11, 2026

Copy link
Copy Markdown

Sorry, @hugovk, I could not cleanly backport this to 3.11 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 9c9df8ac8cbb8f539b3f342d01e40b7a0a57dcbf 3.11

miss-islington-app Bot commented Apr 11, 2026

Copy link
Copy Markdown

Sorry, @hugovk, I could not cleanly backport this to 3.10 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 9c9df8ac8cbb8f539b3f342d01e40b7a0a57dcbf 3.10

hugovk added a commit to hugovk/cpython that referenced this pull request Apr 11, 2026
[3.14] Default GHA permissions to contents: read (pythonGH-148346)
35bf654 
(cherry picked from commit 9c9df8a)

Co-authored-by: Hugo van Kemenade <1324225+hugovk@users.noreply.github.com>

bedevere-app Bot commented Apr 11, 2026

Copy link
Copy Markdown

GH-148386 is a backport of this pull request to the 3.14 branch.

bedevere-app Bot removed the needs backport to 3.14 bugs and security fixes label Apr 11, 2026

bedevere-app Bot commented Apr 11, 2026

Copy link
Copy Markdown

GH-148387 is a backport of this pull request to the 3.13 branch.

bedevere-app Bot removed the needs backport to 3.13 only security fixes label Apr 11, 2026

bedevere-app Bot commented Apr 11, 2026

Copy link
Copy Markdown

GH-148388 is a backport of this pull request to the 3.12 branch.

bedevere-app Bot removed the needs backport to 3.12 only security fixes label Apr 11, 2026
hugovk added a commit to hugovk/cpython that referenced this pull request Apr 11, 2026
[3.13] Default GHA permissions to contents: read (pythonGH-148346)
576eb8d 
(cherry picked from commit 9c9df8a)

Co-authored-by: Hugo van Kemenade <1324225+hugovk@users.noreply.github.com>
hugovk added a commit to hugovk/cpython that referenced this pull request Apr 11, 2026
[3.12] Default GHA permissions to contents: read (pythonGH-148346)
44d5746 
(cherry picked from commit 9c9df8a)

Co-authored-by: Hugo van Kemenade <1324225+hugovk@users.noreply.github.com>

bedevere-app Bot commented Apr 11, 2026

Copy link
Copy Markdown

GH-148389 is a backport of this pull request to the 3.11 branch.

bedevere-app Bot removed the needs backport to 3.11 only security fixes label Apr 11, 2026

bedevere-app Bot commented Apr 11, 2026

Copy link
Copy Markdown

GH-148391 is a backport of this pull request to the 3.10 branch.

illia-v mentioned this pull request Apr 11, 2026
Closed
gpshead pushed a commit that referenced this pull request Apr 12, 2026
[3.14] Default GHA permissions to contents: read (GH-148346) (#148386)
838c602 
(cherry picked from commit 9c9df8a)
gpshead pushed a commit that referenced this pull request Apr 12, 2026
[3.13] Default GHA permissions to contents: read (GH-148346) (#148387)
fdc7f7e 
(cherry picked from commit 9c9df8a)
hugovk added a commit that referenced this pull request Apr 12, 2026
[3.12] Default GHA permissions to contents: read (GH-148346) (#148388)
82b53a6 
(cherry picked from commit 9c9df8a)
hugovk added a commit that referenced this pull request Apr 12, 2026
[3.11] Default GHA permissions to contents: read (GH-148346) (#148389)
776d39f 
(cherry picked from commit 9c9df8a)
hugovk added a commit that referenced this pull request Apr 12, 2026
[3.10] Default GHA permissions to contents: read (GH-148346) (#148391)
80f0bc1 
(cherry picked from commit 9c9df8a)
ljfp pushed a commit to ljfp/cpython that referenced this pull request Apr 25, 2026
Default GHA permissions to contents: read (python#148346)
8f0ee73
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Show hidden characters
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

webknjaz webknjaz approved these changes
ezio-melotti ezio-melotti approved these changes
savannahostrowski Awaiting requested review from savannahostrowski
AA-Turner Awaiting requested review from AA-Turner AA-Turner is a code owner

Assignees

hugovk

Labels

infra CI, GitHub Actions, buildbots, Dependabot, etc. skip issue skip news

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

Back | FazBrowse Home | New Git URL