ci: gate deploy on lint and scope workflow permissions - #55
Merged
Conversation
This was referenced Aug 16, 2026
Drop the blanket workflow permissions in favour of per-job grants, so only the deploy job holds `pages: write` and `id-token: write`. Run `make check` as a job that build depends on, so a lint failure stops the deployment on pushes to main and not only on pull requests. Serialize the deploy job on a `pages` concurrency group to stop overlapping pushes racing each other. Add CODEOWNERS and a monthly Dependabot schedule for npm and actions.
megabyde
force-pushed
the
ci/deploy-gating
branch
from
August 16, 2026 05:54
8f2c50d to
0491841
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Second of three stacked PRs, replacing #53. Based on #54; merge that first and GitHub will retarget this to
main. #56 sits on top of this one. The diff shown here is this commit alone.Permissions
The workflow held
contents: read,pages: write, andid-token: writeat the top level, granting every job the deployment credentials. Nowpermissions: {}at the top with per-job grants, so onlydeploycan write to Pages and mint an OIDC token.Deploy gating
buildnow declaresneeds: lint. Previouslylintandbuildran in parallel anddeploywaited only onbuild, so a failingmake checkon a push tomainstill published. Branch protection would have covered the pull request path but not direct pushes.deploygets apagesconcurrency group withcancel-in-progress: false, so overlapping pushes tomaincannot race the deployment. The group is job-level rather than workflow-level deliberately: this workflow also runs lint and build on pull requests, and a workflow-level group would queue those against deployments.Dependencies
npm ci --ignore-scriptsreplacesnpm install --ignore-scripts --no-package-lock. Without a lockfile, transitive dependencies floated between runs, Dependabot could not see them for advisories, andsetup-node's built-in cache could not be enabled.cache: npmis now on.actions/configure-pagesis removed: nothing consumed its outputs, andpage_urlcomes fromdeploy-pagesitself.Ownership and updates
Adds CODEOWNERS and a monthly Dependabot schedule for npm and github-actions.
Not included
Actions stay pinned to tags rather than commit SHAs. That is a stricter policy worth discussing on its own rather than folding in here.