mirror of
https://github.com/lucide-icons/lucide.git
synced 2026-11-13 13:48:26 +00:00
Thibaud-Vdb
79d4dd48a7
Jobs without a permissions block inherit the repository default token scope. Scopes are derived from what each workflow actually does with the token: - the fourteen package build and test workflows plus the code linter never write through the token, they drop to contents: read. - lint-pr-title.yml gets pull-requests: read, which is what the semantic PR title action documents needing. - comment-icon-preview.yml runs on workflow_run, a privileged trigger processing artifacts produced by fork PRs, so an exact scope matters most there: actions: read to download the artifact, issues: write plus pull-requests: write to post the preview comment, contents: read for the rest. The workflows that already declared scoped permissions (labeler, stale, linting-icons, release and friends) are untouched.
25 lines
589 B
YAML
25 lines
589 B
YAML
name: Linting PR code
|
|
|
|
on:
|
|
pull_request:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
lint-code:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
|
|
- uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0
|
|
- uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
|
|
with:
|
|
cache: 'pnpm'
|
|
node-version-file: 'package.json'
|
|
|
|
- name: Install Dependencies
|
|
run: pnpm install --frozen-lockfile
|
|
|
|
- name: Run Linter
|
|
run: pnpm lint
|