diff --git a/.github/workflows/blocked.yaml b/.github/workflows/blocked.yaml index 1e1bcf4c..cc7db747 100644 --- a/.github/workflows/blocked.yaml +++ b/.github/workflows/blocked.yaml @@ -2,14 +2,14 @@ name: Prevent blocked on: # zizmor: ignore[dangerous-triggers] # Reason: This workflow does not checkout code or use secrets. - # It only reads labels to set a failure status on the PR. + # It only reads labels to set a failure status on the PR. pull_request_target: types: [opened, labeled, unlabeled, synchronize] permissions: pull-requests: read # Required to fail the check on the PR - statuses: write + statuses: write jobs: prevent-blocked: diff --git a/.github/workflows/changelog-label.yml b/.github/workflows/changelog-label.yml index ccbf14b3..f11d3130 100644 --- a/.github/workflows/changelog-label.yml +++ b/.github/workflows/changelog-label.yml @@ -8,7 +8,7 @@ on: types: [labeled, unlabeled, opened] permissions: - pull-requests: read + pull-requests: read statuses: write jobs: diff --git a/.github/workflows/pr-deploy.yaml b/.github/workflows/pr-deploy.yaml index ef0f3314..0084b76b 100644 --- a/.github/workflows/pr-deploy.yaml +++ b/.github/workflows/pr-deploy.yaml @@ -1,7 +1,7 @@ name: Deploy previews for PRs on: # zizmor: ignore[dangerous-triggers] - # Reason: This is now restricted to internal PRs only using the 'if' condition below. + # Reason: This is now restricted to internal PRs only using the 'if' condition below. workflow_run: workflows: ["Build"] types: @@ -16,7 +16,7 @@ jobs: if: > github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'pull_request' && - github.event.workflow_run.head_repository.full_name == github.repository + github.event.workflow_run.head_repository.full_name == github.repository runs-on: ubuntu-latest outputs: pr_number: ${{ steps.prdetails.outputs.pr_id }} diff --git a/.github/workflows/publish-embedded-packages.yaml b/.github/workflows/publish-embedded-packages.yaml index 8ea58ff5..3ab275a5 100644 --- a/.github/workflows/publish-embedded-packages.yaml +++ b/.github/workflows/publish-embedded-packages.yaml @@ -22,7 +22,7 @@ jobs: TAG: ${{ steps.tag.outputs.TAG }} steps: - name: Calculate VERSION - # Safely store dynamic values in environment variables + # Safely store dynamic values in environment variables # to prevent shell injection (template-injection) run: | # The logic is executed within the shell using the env variables