Merge pull request #549 from crazy-max/zizmor-fixes

ci: restrict update-dist GitHub App token scope
2026-07-04 04:02:51 +08:00 · 2026-05-21 14:58:05 +02:00 · 2026-05-21 14:27:36 +02:00
1 changed files with 2 additions and 0 deletions
--- a/.github/workflows/update-dist.yml
+++ b/.github/workflows/update-dist.yml
@ -26,6 +26,8 @@ jobs:
          app-id: ${{ secrets.GHACTIONS_REPO_WRITE_APP_ID }}
          private-key: ${{ secrets.GHACTIONS_REPO_WRITE_APP_PRIVATE_KEY }}
          owner: docker
+          repositories: setup-buildx-action
+          permission-contents: write
      -
        name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
Author	SHA1	Message	Date
CrazyMax	fe05060e96	Merge pull request #549 from crazy-max/zizmor-fixes Some checks failed ci / buildkitd-config (push) Has been cancelled Details ci / buildkitd-config-inline (push) Has been cancelled Details ci / with-qemu (, all) (push) Has been cancelled Details ci / with-qemu (, arm64,riscv64,arm) (push) Has been cancelled Details ci / with-qemu (v0.9.1, all) (push) Has been cancelled Details ci / with-qemu (v0.9.1, arm64,riscv64,arm) (push) Has been cancelled Details ci / build-ref (cb185f095fd3d9444e0aa605d3789e9e05f2a1e7) (push) Has been cancelled Details ci / build-ref (master) (push) Has been cancelled Details ci / build-ref (refs/pull/731/head) (push) Has been cancelled Details ci / build-ref (refs/tags/v0.5.1) (push) Has been cancelled Details ci / standalone-cmd (push) Has been cancelled Details ci / standalone-action (push) Has been cancelled Details ci / append (push) Has been cancelled Details ci / platforms (push) Has been cancelled Details ci / docker-context (push) Has been cancelled Details ci / cleanup (false) (push) Has been cancelled Details ci / cleanup (true) (push) Has been cancelled Details ci / k3s (latest) (push) Has been cancelled Details ci / k3s (v0.10.5) (push) Has been cancelled Details ci / k3s (v0.11.0) (push) Has been cancelled Details ci / cache-binary (false) (push) Has been cancelled Details ci / cache-binary (true) (push) Has been cancelled Details ci / windows-error (push) Has been cancelled Details ci / keep-state (push) Has been cancelled Details ci / keep-state-error (push) Has been cancelled Details codeql / analyze (push) Has been cancelled Details test / test (push) Has been cancelled Details validate / prepare (push) Has been cancelled Details validate / validate (push) Has been cancelled Details zizmor / zizmor (push) Has been cancelled Details ci: restrict update-dist GitHub App token scope	2026-05-21 14:58:05 +02:00
CrazyMax	d717e33d65	ci: restrict update-dist GitHub App token scope Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>	2026-05-21 14:27:36 +02:00