Skip to content

Default GHA permissions to contents: read#148346

Merged
hugovk merged 2 commits intopython:mainfrom
hugovk:3.15-gha-contents-read
Apr 11, 2026
Merged

Default GHA permissions to contents: read#148346
hugovk merged 2 commits intopython:mainfrom
hugovk:3.15-gha-contents-read

Conversation

@hugovk
Copy link
Copy Markdown
Member

@hugovk hugovk commented Apr 10, 2026

Follow on from #148114, so GitHub Actions can run in private forks:

#148114 (comment)

@hugovk hugovk added needs backport to 3.10 only security fixes needs backport to 3.11 only security fixes needs backport to 3.12 only security fixes needs backport to 3.13 bugs and security fixes needs backport to 3.14 bugs and security fixes labels Apr 10, 2026
@hugovk hugovk added skip issue skip news infra CI, GitHub Actions, buildbots, Dependabot, etc. labels Apr 10, 2026
@hugovk hugovk mentioned this pull request Apr 10, 2026
Merged
@hugovk
Copy link
Copy Markdown
Member Author

hugovk commented Apr 10, 2026

build.yml failed in my fork:

Invalid workflow file: .github/workflows/build.yml#L608 The workflow is not valid. .github/workflows/build.yml (Line: 608, Col: 3): Error calling workflow 'hugovk/cpython/.github/workflows/reusable-cifuzz.yml@a959dde4ca2a991f711a79b2c94f0cf2bf127b0a'. The workflow is requesting 'contents: read', but is only allowed 'contents: none'.

https://github.com/hugovk/cpython/actions/runs/24252340106

I think this will pass when merged, because it won't have the mismatch between main and the branch?

@webknjaz
Copy link
Copy Markdown
Member

webknjaz commented Apr 10, 2026

@hugovk you may want to adjust line 616

@hugovk
Copy link
Copy Markdown
Member Author

hugovk commented Apr 10, 2026

@webknjaz This one?

https://github.com/hugovk/cpython/blob/a959dde4ca2a991f711a79b2c94f0cf2bf127b0a/.github/workflows/build.yml#L616

Adjust how?

@webknjaz
Copy link
Copy Markdown
Member

webknjaz commented Apr 10, 2026

Yep, add contents: read there. The calling workflow sets contents: none but the reusable one wants higher privileges, which is what that error is about.

@hugovk
Copy link
Copy Markdown
Member Author

hugovk commented Apr 11, 2026

Thanks, better now: https://github.com/hugovk/cpython/actions/runs/24280156057?pr=148346

@hugovk hugovk merged commit 9c9df8a into python:main Apr 11, 2026
91 checks passed
@hugovk hugovk deleted the 3.15-gha-contents-read branch April 11, 2026 15:37
@miss-islington-app
Copy link
Copy Markdown

miss-islington-app bot commented Apr 11, 2026

Thanks @hugovk for the PR 🌮🎉.. I'm working now to backport this PR to: 3.10, 3.11, 3.12, 3.13, 3.14.
🐍🍒⛏🤖

@miss-islington-app
Copy link
Copy Markdown

miss-islington-app bot commented Apr 11, 2026

Sorry, @hugovk, I could not cleanly backport this to 3.14 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 9c9df8ac8cbb8f539b3f342d01e40b7a0a57dcbf 3.14

@miss-islington-app
Copy link
Copy Markdown

miss-islington-app bot commented Apr 11, 2026

Sorry, @hugovk, I could not cleanly backport this to 3.13 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 9c9df8ac8cbb8f539b3f342d01e40b7a0a57dcbf 3.13

@miss-islington-app
Copy link
Copy Markdown

miss-islington-app bot commented Apr 11, 2026

Sorry, @hugovk, I could not cleanly backport this to 3.12 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 9c9df8ac8cbb8f539b3f342d01e40b7a0a57dcbf 3.12

@miss-islington-app
Copy link
Copy Markdown

miss-islington-app bot commented Apr 11, 2026

Sorry, @hugovk, I could not cleanly backport this to 3.11 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 9c9df8ac8cbb8f539b3f342d01e40b7a0a57dcbf 3.11

@miss-islington-app
Copy link
Copy Markdown

miss-islington-app bot commented Apr 11, 2026

Sorry, @hugovk, I could not cleanly backport this to 3.10 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 9c9df8ac8cbb8f539b3f342d01e40b7a0a57dcbf 3.10

hugovk added a commit to hugovk/cpython that referenced this pull request Apr 11, 2026
@hugovk
[3.14] Default GHA permissions to contents: read (pythonGH-148346)
35bf654 
(cherry picked from commit 9c9df8a)

Co-authored-by: Hugo van Kemenade <1324225+hugovk@users.noreply.github.com>
@bedevere-app
Copy link
Copy Markdown

bedevere-app bot commented Apr 11, 2026

GH-148386 is a backport of this pull request to the 3.14 branch.

@bedevere-app bedevere-app bot removed the needs backport to 3.14 bugs and security fixes label Apr 11, 2026
@bedevere-app
Copy link
Copy Markdown

bedevere-app bot commented Apr 11, 2026

GH-148387 is a backport of this pull request to the 3.13 branch.

@bedevere-app bedevere-app bot removed the needs backport to 3.13 bugs and security fixes label Apr 11, 2026
@bedevere-app
Copy link
Copy Markdown

bedevere-app bot commented Apr 11, 2026

GH-148388 is a backport of this pull request to the 3.12 branch.

@bedevere-app bedevere-app bot removed the needs backport to 3.12 only security fixes label Apr 11, 2026
hugovk added a commit to hugovk/cpython that referenced this pull request Apr 11, 2026
@hugovk
[3.13] Default GHA permissions to contents: read (pythonGH-148346)
576eb8d 
(cherry picked from commit 9c9df8a)

Co-authored-by: Hugo van Kemenade <1324225+hugovk@users.noreply.github.com>
hugovk added a commit to hugovk/cpython that referenced this pull request Apr 11, 2026
@hugovk
[3.12] Default GHA permissions to contents: read (pythonGH-148346)
44d5746 
(cherry picked from commit 9c9df8a)

Co-authored-by: Hugo van Kemenade <1324225+hugovk@users.noreply.github.com>
@bedevere-app
Copy link
Copy Markdown

bedevere-app bot commented Apr 11, 2026

GH-148389 is a backport of this pull request to the 3.11 branch.

@bedevere-app bedevere-app bot removed the needs backport to 3.11 only security fixes label Apr 11, 2026
@bedevere-app
Copy link
Copy Markdown

bedevere-app bot commented Apr 11, 2026

GH-148391 is a backport of this pull request to the 3.10 branch.

@bedevere-app bedevere-app bot removed the needs backport to 3.10 only security fixes label Apr 11, 2026
@illia-v illia-v mentioned this pull request Apr 11, 2026
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@webknjaz webknjaz webknjaz approved these changes

@ezio-melotti ezio-melotti ezio-melotti approved these changes

@savannahostrowski savannahostrowski Awaiting requested review from savannahostrowski savannahostrowski is a code owner

@AA-Turner AA-Turner Awaiting requested review from AA-Turner AA-Turner is a code owner

Assignees

@hugovk hugovk

Labels

infra CI, GitHub Actions, buildbots, Dependabot, etc. skip issue skip news

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@hugovk @webknjaz @ezio-melotti