mirror of
https://github.com/vmware-tanzu/velero.git
synced 2026-09-13 11:34:54 +00:00
Shubham Pampattiwar
3191e38ac3
Add an explicit top-level permissions block to the GitHub Actions workflows that were relying on the default token permissions. Each workflow now defaults to contents: read, with additional scopes granted only where a job needs them: * nightly-trivy-scan keeps security-events: write at the job level to upload SARIF results, plus contents: read for checkout. * stale-issues gets issues: write and pull-requests: write for the actions/stale action to label and close stale items. Setting least-privilege permissions reduces the blast radius if a workflow or one of its dependencies is compromised, and satisfies the CLOMonitor token_permissions check. Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
30 lines
1.5 KiB
YAML
30 lines
1.5 KiB
YAML
name: "Close stale issues and PRs"
|
|
on:
|
|
schedule:
|
|
- cron: "30 1 * * *" # Every day at 1:30 UTC
|
|
|
|
permissions:
|
|
contents: read
|
|
issues: write
|
|
pull-requests: write
|
|
|
|
jobs:
|
|
stale:
|
|
if: github.repository == 'velero-io/velero'
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/stale@v11.0.0
|
|
with:
|
|
repo-token: ${{ secrets.GITHUB_TOKEN }}
|
|
stale-issue-message: "This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 14 days. If a Velero team member has requested log or more information, please provide the output of the shared commands."
|
|
close-issue-message: "This issue was closed because it has been stalled for 14 days with no activity."
|
|
days-before-issue-stale: 60
|
|
days-before-issue-close: 14
|
|
stale-issue-label: staled
|
|
# Disable stale PRs for now; they can remain open.
|
|
days-before-pr-stale: -1
|
|
days-before-pr-close: -1
|
|
# Only issues made after Feb 09 2021.
|
|
start-date: "2021-09-02T00:00:00"
|
|
exempt-issue-labels: "Epic,Area/CLI,Area/Cloud/AWS,Area/Cloud/Azure,Area/Cloud/GCP,Area/Cloud/vSphere,Area/CSI,Area/Design,Area/Documentation,Area/Plugins,Bug,Enhancement/User,kind/requirement,kind/refactor,kind/tech-debt,limitation,Needs investigation,Needs triage,Needs Product,P0 - Hair on fire,P1 - Important,P2 - Long-term important,P3 - Wouldn't it be nice if...,Product Requirements,release-blocker,Security,backlog"
|