Merge pull request #78 from crazy-max/gha-perms

ci: set contents read as default workflow permissions

Author: crazy-max

.github/workflows/build.yml

@@ -4,6 +4,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
+permissions:
+  contents: read
+
 on:
   push:
     branches:
@@ -135,6 +139,9 @@ jobs:
 
   release:
     runs-on: ubuntu-latest
+    permissions:
+      # required to create GitHub release
+      contents: write
     needs:
       - artifact
       - test
@@ -175,6 +182,11 @@ jobs:
 
   image:
     runs-on: ubuntu-latest
+    permissions:
+      # same as global permissions
+      contents: read
+      # required to push to GHCR
+      packages: write
     needs:
       - artifact
       - test

.github/workflows/codeql.yml

@@ -4,6 +4,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
+permissions:
+  contents: read
+
 on:
   schedule:
     - cron: '0 12 * * 6'
@@ -17,6 +21,11 @@ on:
 jobs:
   codeql:
     runs-on: ubuntu-latest
+    permissions:
+      # same as global permissions
+      contents: read
+      # required for code scanning
+      security-events: write
     steps:
       -
         name: Checkout

.github/workflows/labels.yml

@@ -4,21 +4,36 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
+permissions:
+  contents: read
+
 on:
   push:
     branches:
       - 'master'
     paths:
       - '.github/labels.yml'
       - '.github/workflows/labels.yml'
+  pull_request:
+    paths:
+      - '.github/labels.yml'
+      - '.github/workflows/labels.yml'
 
 jobs:
   labeler:
     runs-on: ubuntu-latest
+    permissions:
+      # same as global permissions
+      contents: read
+      # required to update labels
+      issues: write
     steps:
       -
         name: Checkout
         uses: actions/checkout@v4
       -
         name: Run Labeler
         uses: crazy-max/ghaction-github-labeler@v5
+        with:
+          dry-run: ${{ github.event_name == 'pull_request' }}

.github/workflows/test.yml

@@ -4,6 +4,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
+permissions:
+  contents: read
+
 on:
   push:
     branches:

README.md

@@ -92,20 +92,19 @@ yasu nobody true
 Following platforms for this image are available:
 
 ```
-$ docker run --rm mplatform/mquery crazymax/yasu:latest
-Image: crazymax/yasu:latest
- * Manifest List: Yes
- * Supported platforms:
-   - linux/386
-   - linux/amd64
-   - linux/arm/v5
-   - linux/arm/v6
-   - linux/arm/v7
-   - linux/arm64
-   - linux/mips64le
-   - linux/ppc64le
-   - linux/riscv64
-   - linux/s390x
+$ docker buildx imagetools inspect crazymax/yasu --format "{{json .Manifest}}" | \
+  jq -r '.manifests[] | select(.platform.os != null and .platform.os != "unknown") | .platform | "\(.os)/\(.architecture)\(if .variant then "/" + .variant else "" end)"'
+
+linux/386
+linux/amd64
+linux/arm/v5
+linux/arm/v6
+linux/arm/v7
+linux/arm64
+linux/mips64le
+linux/ppc64le
+linux/riscv64
+linux/s390x
 ```
 
 Here is how to use `yasu` inside your Dockerfile: