From 8e5a465028e286f09a9852e737bc688386dd2128 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Oliv=C3=A9r=20Kecskem=C3=A9ty?= Date: Fri, 23 Oct 2026 22:47:57 +0200 Subject: [PATCH] Allow labeling jobs a write scope on pull requests --- docs/workflows.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/workflows.md b/docs/workflows.md index e28b496..f118958 100644 --- a/docs/workflows.md +++ b/docs/workflows.md @@ -12,7 +12,7 @@ Every GitHub Actions workflow and composite action in the studio's repositories ## Permissions and secrets - A workflow grants no more than reading by default: `permissions` is always set at the top, normally to `contents: read`. Write scopes go on the one job that needs them. -- A job that runs on pull requests holds a write scope only if every step that uses it is skipped on pull requests. Today this covers the single build-and-push jobs of the publish workflows, until they move to a shared publish workflow that splits building from pushing. +- No code from a pull request runs with a write scope. A job that runs on pull requests holds one only if every step that uses it is skipped on pull requests, or if the job checks nothing out and its steps are pinned actions that act on the pull request itself. The first case covers today's single build-and-push jobs of the publish workflows, until they move to a shared publish workflow that splits building from pushing; the second covers labeling pull requests. - Secrets are passed only on events other than `pull_request` (review). - Checkouts set `persist-credentials: false`; a job that pushes keeps the credentials and says why in a comment. - Every action is pinned by its full commit SHA with the release in a comment, `@ # vX.Y.Z`. Renovate keeps the pins current.