docs: More restrictive permissions (#280)

* Update README.md

* Update README.md

* permissions block moved

* permissions block moved

* Update lint-pr-title-preview-validateSingleCommit.yml

* Update lint-pr-title-preview.yml

* Update lint-pr-title.yml

* Update release.yml

* Update versioning.yml

* permissions block move, added `-o pipefail` flag for pipe errors

* Update lint-pr-title-preview-outputErrorMessage.yml

* fix(url): remove ). for the see url msg

* Revert to secrets.GITHUB_TOKEN

changed back to using secrets.GITHUB_TOKEN as requested by owner

---------

Co-authored-by: lior-dux_clbt <[email protected]>

Author: zMynxx

.github/workflows/lint-pr-title-preview-ignoreLabels.yml

@@ -8,12 +8,11 @@ on:
       - labeled
       - unlabeled
 
-permissions:
-  pull-requests: read
-
 jobs:
   main:
     runs-on: ubuntu-latest
+    permissions:
+      pull-requests: read
     steps:
       - uses: actions/checkout@v3
       - uses: actions/setup-node@v3

.github/workflows/lint-pr-title-preview-outputErrorMessage.yml

@@ -6,12 +6,11 @@ on:
       - edited
       - synchronize
 
-permissions:
-  pull-requests: write
-
 jobs:
   main:
     runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
     steps:
       - uses: actions/checkout@v3
       - uses: actions/setup-node@v3
@@ -44,4 +43,4 @@ jobs:
         uses: marocchino/sticky-pull-request-comment@v2
         with:   
           header: pr-title-lint-error
-          delete: true
+          delete: true

.github/workflows/lint-pr-title-preview-validateSingleCommit.yml

@@ -6,12 +6,11 @@ on:
       - edited
       - synchronize
 
-permissions:
-  pull-requests: read
-
 jobs:
   main:
     runs-on: ubuntu-latest
+    permissions:
+      pull-requests: read
     steps:
       - uses: actions/checkout@v3
       - uses: actions/setup-node@v3

.github/workflows/lint-pr-title-preview.yml

@@ -6,12 +6,11 @@ on:
       - edited
       - synchronize
 
-permissions:
-  pull-requests: read
-
 jobs:
   main:
     runs-on: ubuntu-latest
+    permissions:
+      pull-requests: read
     steps:
       - uses: actions/checkout@v3
       - uses: actions/setup-node@v3

.github/workflows/lint-pr-title.yml

@@ -6,12 +6,11 @@ on:
       - edited
       - synchronize
 
-permissions:
-  pull-requests: read
-
 jobs:
   main:
     runs-on: ubuntu-latest
+    permissions:
+      pull-requests: read
     steps:
       - uses: actions/checkout@v3
       - uses: actions/setup-node@v3

.github/workflows/release.yml

@@ -4,15 +4,14 @@ on:
     branches:
       - main
 
-permissions:
-  contents: write
-  deployments: write
-  issues: write
-  pull-requests: write
-
 jobs:
   main:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      deployments: write
+      issues: write
+      pull-requests: write
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4

.github/workflows/test.yml

@@ -6,12 +6,11 @@ on:
       - reopened
       - synchronize
 
-permissions:
-  contents: read
-
 jobs:
   main:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@v3
       - uses: actions/setup-node@v3
@@ -22,13 +21,15 @@ jobs:
 
   dist:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@v3
         with: 
           fetch-depth: 0
       - name: Check if `dist/` has been modified.
         run: |
-          set -eux
+          set -euxo pipefail
 
           if [ $(git diff origin/main --name-only -- 'dist/**' | wc -l) -gt 0 ]
           then

.github/workflows/versioning.yml

@@ -4,11 +4,10 @@ on:
   release:
     types: [published, edited]
 
-permissions:
-  deployments: write
-
 jobs:
   actions-tagger:
     runs-on: ubuntu-latest
+    permissions:
+      deployments: write
     steps:
       - uses: Actions-R-Us/actions-tagger@v2

README.md

@@ -31,13 +31,12 @@ on:
       - synchronize
       - reopened
 
-permissions:
-  pull-requests: read
-
 jobs:
   main:
     name: Validate PR title
     runs-on: ubuntu-latest
+    permissions:
+      pull-requests: read
     steps:
       - uses: amannn/action-semantic-pull-request@v5
         env:
@@ -135,6 +134,8 @@ jobs:
   main:
     name: Validate PR title
     runs-on: ubuntu-latest
+    permissions:
+      pull-requests: read
     steps:
       - uses: amannn/action-semantic-pull-request@v5
         env:
@@ -192,6 +193,8 @@ jobs:
   main:
     name: Validate PR title
     runs-on: ubuntu-latest
+    permissions:
+      pull-requests: read
     steps:
       - uses: amannn/action-semantic-pull-request@v5
         id: lint_pr_title

src/index.js

@@ -118,7 +118,7 @@ module.exports = async function run() {
               });
             } catch (error) {
               throw new Error(
-                `Pull request has only one commit and it's not semantic; this may lead to a non-semantic commit in the base branch (see https://github.com/community/community/discussions/16271). Amend the commit message to match the pull request title, or add another commit.`
+                `Pull request has only one commit and it's not semantic; this may lead to a non-semantic commit in the base branch (see https://github.com/community/community/discussions/16271 ). Amend the commit message to match the pull request title, or add another commit.`
               );
             }