ci(test): declare contents: read on the unit-test workflow#4736
ci(test): declare contents: read on the unit-test workflow#4736arpitjain099 wants to merge 1 commit into
Conversation
Build + verify jobs only check out source, run `make test` / `make quick-ci`, and upload to Codecov via codecov-action (uses secrets.CODECOV_TOKEN; the default GITHUB_TOKEN is not used for codecov uploads on push). Signed-off-by: Arpit Jain <arpitjain099@gmail.com>
|
Welcome @arpitjain099! |
|
Hi @arpitjain099. Thanks for your PR. I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with Regular contributors should join the org to skip this step. Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: arpitjain099 The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
a5bdf61 to
121b954
Compare
|
Hi @shraddhabang, gentle ping on this. PR has been open for 4 days without review. I noticed you've been on the recent-approver side of recent merges in this repo. When you have a moment, would you mind giving it a quick look? No urgency. Happy to address any feedback. |
Pins the default
GITHUB_TOKENto read-only for theUnit Testworkflow. The two jobs only runmake test/make quick-ciand upload coverage throughcodecov/codecov-action, which authenticates viaCODECOV_TOKEN.Sibling workflows (
ci.yaml,scripts.yaml,update-base-image.yaml) already declare their permissions. YAML validated locally.