Skip to content

Commit 4d8db18

Browse files
chensuyuechensuyue
authored
Merge branch 'main' into feature/CodeGen_CodeTrans_k8s
2 parents 1e654ee + 9e38a56 commit 4d8db18

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

46 files changed

+370
-279
lines changed

‎.github/workflows/_build_comps_base_image.yml

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,12 @@
22
# SPDX-License-Identifier: Apache-2.0
33

44
name: Build Comps Base Image
5-
permissions: read-all
5+
6+
permissions:
7+
attestations: read
8+
models: read
9+
security-events: read
10+
611
on:
712
workflow_call:
813
inputs:

‎.github/workflows/_build_image.yml

Lines changed: 16 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,22 @@
22
# SPDX-License-Identifier: Apache-2.0
33

44
name: Build Images
5-
permissions: read-all
5+
permissions:
6+
actions: read
7+
contents: read
8+
checks: read
9+
deployments: read
10+
discussions: read
11+
issues: read
12+
packages: read
13+
pages: read
14+
pull-requests: read
15+
repository-projects: read
16+
statuses: read
17+
security-events: read
18+
id-token: write
19+
attestations: read
20+
models: read
621
on:
722
workflow_call:
823
inputs:

‎.github/workflows/_example-workflow.yml

Lines changed: 16 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,22 @@
22
# SPDX-License-Identifier: Apache-2.0
33

44
name: Example jobs
5-
permissions: read-all
5+
permissions:
6+
actions: read
7+
contents: read
8+
checks: read
9+
deployments: read
10+
discussions: read
11+
issues: read
12+
packages: read
13+
pages: read
14+
pull-requests: read
15+
repository-projects: read
16+
statuses: read
17+
security-events: read
18+
id-token: write
19+
attestations: read
20+
models: read
621
on:
722
workflow_call:
823
inputs:

‎.github/workflows/_get-image-list.yml

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,8 @@
22
# SPDX-License-Identifier: Apache-2.0
33

44
name: Get Image List
5-
permissions: read-all
5+
permissions:
6+
contents: read
67
on:
78
workflow_call:
89
inputs:

‎.github/workflows/_gmc-e2e.yml

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,8 @@
33

44
# This workflow will only test GMC pipeline and will not install GMC any more
55
name: Single GMC E2e Test For CD Workflow Call
6-
6+
permissions:
7+
contents: read
78
on:
89
workflow_call:
910
inputs:

‎.github/workflows/_gmc-workflow.yml

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,8 @@
22
# SPDX-License-Identifier: Apache-2.0
33

44
name: Build and deploy GMC system on call and manual
5-
5+
permissions:
6+
contents: read
67
on:
78
workflow_dispatch:
89
inputs:

‎.github/workflows/dockerhub-description.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,8 @@
22
# SPDX-License-Identifier: Apache-2.0
33

44
name: Update Docker Hub Description
5+
permissions:
6+
contents: read
57
on:
68
schedule:
79
- cron: "0 0 * * 0"

‎.github/workflows/manual-docker-clean.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,8 @@
22
# SPDX-License-Identifier: Apache-2.0
33

44
name: Clean up container on manual event
5+
permissions:
6+
contents: read
57
on:
68
workflow_dispatch:
79
inputs:

‎.github/workflows/manual-example-workflow.yml

Lines changed: 18 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,24 @@
22
# SPDX-License-Identifier: Apache-2.0
33

44
name: Examples CD workflow on manual event
5+
6+
permissions:
7+
actions: read
8+
contents: read
9+
checks: read
10+
deployments: read
11+
discussions: read
12+
issues: read
13+
packages: read
14+
pages: read
15+
pull-requests: read
16+
repository-projects: read
17+
statuses: read
18+
security-events: read
19+
id-token: write
20+
attestations: read
21+
models: read
22+
523
on:
624
workflow_dispatch:
725
inputs:
@@ -51,7 +69,6 @@ on:
5169
required: false
5270
type: boolean
5371

54-
permissions: read-all
5572
jobs:
5673
get-test-matrix:
5774
runs-on: ubuntu-latest

‎.github/workflows/manual-freeze-tag.yml

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,8 @@
22
# SPDX-License-Identifier: Apache-2.0
33

44
name: Freeze OPEA images release tag
5-
5+
permissions:
6+
contents: read
67
on:
78
workflow_dispatch:
89
inputs:

‎.github/workflows/manual-image-build.yml

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,22 @@
22
# SPDX-License-Identifier: Apache-2.0
33

44
name: Build specific images on manual event
5+
permissions:
6+
actions: read
7+
contents: read
8+
checks: read
9+
deployments: read
10+
discussions: read
11+
issues: read
12+
packages: read
13+
pages: read
14+
pull-requests: read
15+
repository-projects: read
16+
statuses: read
17+
security-events: read
18+
id-token: write
19+
attestations: read
20+
models: read
521
on:
622
workflow_dispatch:
723
inputs:

‎.github/workflows/manual-reset-local-registry.yml

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,22 @@
22
# SPDX-License-Identifier: Apache-2.0
33

44
name: Clean up Local Registry on manual event
5+
permissions:
6+
actions: read
7+
contents: read
8+
checks: read
9+
deployments: read
10+
discussions: read
11+
issues: read
12+
packages: read
13+
pages: read
14+
pull-requests: read
15+
repository-projects: read
16+
statuses: read
17+
security-events: read
18+
id-token: write
19+
attestations: read
20+
models: read
521
on:
622
workflow_dispatch:
723
inputs:

‎.github/workflows/mix-trellix.yml

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,8 @@
22
# SPDX-License-Identifier: Apache-2.0
33

44
name: Trellix Command Line Scanner
5-
5+
permissions:
6+
contents: read
67
on:
78
workflow_dispatch:
89
schedule:

‎.github/workflows/nightly-docker-build-publish.yml

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,8 @@
22
# SPDX-License-Identifier: Apache-2.0
33

44
name: Nightly build/publish latest docker images
5+
permissions:
6+
security-events: read
57

68
on:
79
schedule:
@@ -33,12 +35,32 @@ jobs:
3335
echo "PUBLISH_TAGS=$PUBLISH_TAGS" >> $GITHUB_OUTPUT
3436
3537
build-comps-base:
38+
permissions:
39+
attestations: read
40+
models: read
41+
security-events: read
3642
needs: [get-build-matrix]
3743
uses: ./.github/workflows/_build_comps_base_image.yml
3844
with:
3945
node: gaudi
4046

4147
build-images:
48+
permissions:
49+
actions: read
50+
contents: read
51+
checks: read
52+
deployments: read
53+
discussions: read
54+
issues: read
55+
packages: read
56+
pages: read
57+
pull-requests: read
58+
repository-projects: read
59+
statuses: read
60+
security-events: read
61+
id-token: write
62+
attestations: read
63+
models: read
4264
needs: [get-build-matrix, build-comps-base]
4365
strategy:
4466
matrix:
@@ -53,6 +75,22 @@ jobs:
5375

5476
test-example:
5577
needs: [get-build-matrix]
78+
permissions:
79+
actions: read
80+
contents: read
81+
checks: read
82+
deployments: read
83+
discussions: read
84+
issues: read
85+
packages: read
86+
pages: read
87+
pull-requests: read
88+
repository-projects: read
89+
statuses: read
90+
security-events: read
91+
id-token: write
92+
attestations: read
93+
models: read
5694
if: ${{ needs.get-build-matrix.outputs.examples_json != '' }}
5795
strategy:
5896
matrix:
@@ -69,6 +107,8 @@ jobs:
69107

70108
get-image-list:
71109
needs: [get-build-matrix]
110+
permissions:
111+
contents: read
72112
uses: ./.github/workflows/_get-image-list.yml
73113
with:
74114
examples: ${{ needs.get-build-matrix.outputs.EXAMPLES }}

‎.github/workflows/pr-chart-e2e.yml

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,8 @@
22
# SPDX-License-Identifier: Apache-2.0
33

44
name: E2E Test with Helm Charts
5-
5+
permissions:
6+
contents: read
67
on:
78
pull_request_target:
89
branches: [main]

‎.github/workflows/pr-check-duplicated-image.yml

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,8 @@
22
# SPDX-License-Identifier: Apache-2.0
33

44
name: Check Duplicated Images
5-
5+
permissions:
6+
contents: read
67
on:
78
pull_request:
89
branches: [main]

‎.github/workflows/pr-code-scan.yml

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,9 @@
22
# SPDX-License-Identifier: Apache-2.0
33

44
name: Code Scan
5-
5+
permissions:
6+
contents: read
7+
security-events: write
68
on:
79
pull_request:
810
branches: [main]

‎.github/workflows/pr-docker-compose-e2e.yml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,9 @@
33

44
name: E2E test with docker compose
55

6+
permissions:
7+
contents: read
8+
69
on:
710
pull_request_target:
811
branches: ["main", "*rc"]

‎.github/workflows/pr-dockerfile-path-and-build-yaml-scan.yml

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,8 @@
22
# SPDX-License-Identifier: Apache-2.0
33

44
name: Compose file and dockerfile path checking
5-
5+
permissions:
6+
contents: read
67
on:
78
pull_request:
89
branches: [main]

‎.github/workflows/pr-link-path-scan.yml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,9 @@
33

44
name: Check hyperlinks and relative path validity
55

6+
permissions:
7+
contents: read
8+
69
on:
710
pull_request:
811
branches: [main]

‎.github/workflows/push-image-build.yml

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,23 @@
33
# Test
44
name: Build latest images on push event
55

6+
permissions:
7+
actions: read
8+
contents: read
9+
checks: read
10+
deployments: read
11+
discussions: read
12+
issues: read
13+
packages: read
14+
pages: read
15+
pull-requests: read
16+
repository-projects: read
17+
statuses: read
18+
security-events: read
19+
id-token: write
20+
attestations: read
21+
models: read
22+
623
on:
724
push:
825
branches: [ 'main' ]

‎.github/workflows/push-images-path-detection.yml

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,10 +3,12 @@
33

44
name: Check the validity of links in docker_images_list.
55

6+
permissions:
7+
contents: read
8+
69
on:
710
push:
811
branches: [main]
9-
types: [opened, reopened, ready_for_review, synchronize]
1012

1113
jobs:
1214
check-dockerfile-paths:

‎.github/workflows/push-infra-issue-creation.yml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,10 @@ on:
88
- "**/docker_compose/**/compose*.yaml"
99

1010
name: Create an issue to GenAIInfra on push
11+
12+
permissions:
13+
contents: read
14+
1115
jobs:
1216
job1:
1317
name: Create issue

0 commit comments

Comments
 (0)