Skip to content

Fix workflow to bypass missing permissions for dependabot PRs #160

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
chipp merged 1 commit into from
Jun 3, 2026
Merged

Fix workflow to bypass missing permissions for dependabot PRs #160

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 16 additions & 5 deletions .github/workflows/pr.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,9 @@ on:
branches:
- main

permissions:
contents: read

jobs:
fmt:
runs-on: ubuntu-24.04-arm
Expand Down Expand Up @@ -130,6 +133,10 @@ jobs:
test:
runs-on: ubuntu-24.04-arm
needs: [fmt, clippy, deny]
permissions:
contents: read
packages: read
actions: write

strategy:
matrix:
Expand All @@ -143,9 +150,6 @@ jobs:
steps:
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5

- name: Log into registry
run: echo ${{ secrets.CR_PAT }} | docker login ghcr.io -u $GITHUB_ACTOR --password-stdin

- name: Set up Docker Buildx
id: buildx
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd
Expand All @@ -157,17 +161,24 @@ jobs:
run: |
IMAGE_ID=ghcr.io/chipp/${{ matrix.binary }}
RUST_VERSION=$(cat .rust-version)
CACHE_TO_TEST=()
CACHE_TO_IMAGE=()

if [ "${{ github.actor }}" != "dependabot[bot]" ]; then
CACHE_TO_TEST=("--cache-to=type=gha,scope=${{ matrix.binary }}-test,mode=max")
CACHE_TO_IMAGE=("--cache-to=type=gha,scope=${{ matrix.binary }},mode=max")
fi

docker buildx build . --file bin/${{ matrix.binary }}/test.Dockerfile \
--output type=cacheonly \
--tag $IMAGE_ID:latest \
--build-arg RUST_VERSION="${RUST_VERSION}" \
--cache-from=type=gha,scope=${{ matrix.binary }}-test \
--cache-to=type=gha,scope=${{ matrix.binary }}-test,mode=max
"${CACHE_TO_TEST[@]}"

docker buildx build . --file bin/${{ matrix.binary }}/Dockerfile \
--output type=cacheonly \
--tag $IMAGE_ID:latest \
--build-arg RUST_VERSION="${RUST_VERSION}" \
--cache-from=type=gha,scope=${{ matrix.binary }} \
--cache-to=type=gha,scope=${{ matrix.binary }},mode=max
"${CACHE_TO_IMAGE[@]}"
Loading