From 43689e57b9ab93f3c0b1273b1b9215f43f9d2497 Mon Sep 17 00:00:00 2001 From: Alex Batisse Date: Mon, 4 May 2026 22:02:57 +0200 Subject: [PATCH 1/4] ci: Build snap and flake in CI --- .github/workflows/ci.yaml | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 366ee03..678a80b 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -10,6 +10,9 @@ on: env: FORCE_COLOR: "1" +permissions: + contents: read + jobs: lint: name: Lint @@ -56,3 +59,15 @@ jobs: - name: Run tests run: nox -s tests + + validate_build: + name: Build artifacts + need: [lint, tests] + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v6 + - uses: snapcore/action-build@v1 + name: Build snap + - uses: "DeterminateSystems/nix-installer-action@main" + - run: nix build + name: Build Flake From e29381a15d5b07d080b83e946f98e1aa58512d51 Mon Sep 17 00:00:00 2001 From: Alex Batisse Date: Mon, 4 May 2026 22:03:22 +0200 Subject: [PATCH 2/4] ci: Restrict workflow permissions --- .github/workflows/publish-tagged.yml | 8 ++++++-- .github/workflows/release.yaml | 3 +++ 2 files changed, 9 insertions(+), 2 deletions(-) diff --git a/.github/workflows/publish-tagged.yml b/.github/workflows/publish-tagged.yml index d9a41e9..2a4aa35 100644 --- a/.github/workflows/publish-tagged.yml +++ b/.github/workflows/publish-tagged.yml @@ -9,12 +9,16 @@ on: description: "The existing tag to publish" type: "string" required: true + +permissions: + contents: read + jobs: flakehub-publish: runs-on: "ubuntu-latest" permissions: - id-token: "write" - contents: "read" + contents: read + id-token: write steps: - uses: actions/checkout@v6 with: diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 2e02cdf..d9d06a6 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -3,6 +3,9 @@ name: Publish on: workflow_dispatch: +permissions: + contents: read + jobs: build: name: Build wheel From 6d879c7f4dbf678baa809df5f14a4848ab397c21 Mon Sep 17 00:00:00 2001 From: Alex Batisse Date: Mon, 4 May 2026 22:06:10 +0200 Subject: [PATCH 3/4] ci: Fix indent --- .github/workflows/ci.yaml | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 678a80b..a3e6dad 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -60,14 +60,14 @@ jobs: - name: Run tests run: nox -s tests - validate_build: - name: Build artifacts - need: [lint, tests] - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v6 - - uses: snapcore/action-build@v1 - name: Build snap - - uses: "DeterminateSystems/nix-installer-action@main" - - run: nix build - name: Build Flake + validate_build: + name: Build artifacts + need: [lint, tests] + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v6 + - uses: snapcore/action-build@v1 + name: Build snap + - uses: "DeterminateSystems/nix-installer-action@main" + - run: nix build + name: Build Flake From a21b2cb5a3b3ebe0be6e205927c18f28fe543e7d Mon Sep 17 00:00:00 2001 From: Alex Batisse Date: Mon, 4 May 2026 22:07:04 +0200 Subject: [PATCH 4/4] ci: Typo --- .github/workflows/ci.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index a3e6dad..05448bb 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -62,7 +62,7 @@ jobs: validate_build: name: Build artifacts - need: [lint, tests] + needs: [lint, tests] runs-on: ubuntu-latest steps: - uses: actions/checkout@v6