GH-49729: [CI] Scope workflow permissions and secret inheritance#49773
Conversation
|
|
github-actions
Bot
added
CI: Extra: C++
|
I think the failing jobs are ones which are failing on main, but perhaps we wait for those to be fixed so I can rebase and properly check they pass here. |
kou
left a comment
kou
left a comment
There was a problem hiding this comment.
+1
report_ci is only triggered by schedule event. (Nightly jobs.)
So we can't test this with PR.
Could you fill the PR description before we merge this?
github-actions
Bot
added
awaiting merge
|
After merging your PR, Conbench analyzed the 3 benchmarking runs that have been run so far on merge-commit 1cfbb67. There were no benchmark performance regressions. 🎉 The full Conbench report has more details. It also includes information about 1 possible false positive for unstable benchmarks that are known to sometimes produce them. |
apache#49773) ### Rationale for this change CI jobs allow secrets to be inherited which could present a security risk ### What changes are included in this PR? Scope permissions better ### Are these changes tested? Will be once we merge ### Are there any user-facing changes? No * GitHub Issue: apache#49729 Authored-by: Nic Crane <thisisnic@gmail.com> Signed-off-by: Nic Crane <thisisnic@gmail.com>
2 participants
Rationale for this change
CI jobs allow secrets to be inherited which could present a security risk
What changes are included in this PR?
Scope permissions better
Are these changes tested?
Will be once we merge
Are there any user-facing changes?
No