From 594f469b913295bc8e2d446718fac4eefc1e1a5d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Oliv=C3=A9r=20Kecskem=C3=A9ty?= Date: Fri, 23 Oct 2026 23:44:50 +0200 Subject: [PATCH] Allow upload tokens on pull request runs --- docs/workflows.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/workflows.md b/docs/workflows.md index f118958..18c3dbf 100644 --- a/docs/workflows.md +++ b/docs/workflows.md @@ -13,7 +13,7 @@ Every GitHub Actions workflow and composite action in the studio's repositories - A workflow grants no more than reading by default: `permissions` is always set at the top, normally to `contents: read`. Write scopes go on the one job that needs them. - No code from a pull request runs with a write scope. A job that runs on pull requests holds one only if every step that uses it is skipped on pull requests, or if the job checks nothing out and its steps are pinned actions that act on the pull request itself. The first case covers today's single build-and-push jobs of the publish workflows, until they move to a shared publish workflow that splits building from pushing; the second covers labeling pull requests. -- Secrets are passed only on events other than `pull_request` (review). +- Secrets are passed only on events other than `pull_request`, except upload tokens that can only add reports, such as Codecov's (review). - Checkouts set `persist-credentials: false`; a job that pushes keeps the credentials and says why in a comment. - Every action is pinned by its full commit SHA with the release in a comment, `@ # vX.Y.Z`. Renovate keeps the pins current.