Skip to content

Commit 583bacc

Browse files
authored
fix(ci): apply lessons learned to monthly roadmap reminder cross-repo (#4078)
* fix(parameters): make cache aware of single vs multiple calls Signed-off-by: heitorlessa <[email protected]> * chore: cleanup, add test for single and nested Signed-off-by: heitorlessa <[email protected]> * chore: first experiment with central but private workflow * chore: test workflow * chore(ci): test with branch over sha as it was not found * chore(ci): use secrets for new workflow_call * chore(ci): update named secret input * chore(ci): apply least-privilege permissions at job level * chore(ci): make monthly roadmap reminder workflow immutable for sec * chore(ci): add note about cronjob * chore: add powertools actions to allow list until releases are done Signed-off-by: heitorlessa <[email protected]> --------- Signed-off-by: heitorlessa <[email protected]> Signed-off-by: Heitor Lessa <[email protected]>
1 parent 7830401 commit 583bacc

File tree

2 files changed

+14
-8
lines changed

2 files changed

+14
-8
lines changed

.github/workflows/on_schedule_monthly_roadmap_reminder.yml

+11-7
Original file line numberDiff line numberDiff line change
@@ -2,17 +2,21 @@ name: Monthly roadmap reminder
22

33
on:
44
workflow_dispatch: {}
5-
# schedule:
6-
# - cron: '0 0 1 * *'
5+
schedule:
6+
- cron: '0 0 1 * *' # runs first day of the month
77

88
permissions:
99
contents: read
10-
pull-requests: read
11-
issues: read
1210

1311

1412
jobs:
1513
call-workflow-passing-data:
16-
uses: aws-powertools/actions/.github/workflows/monthly_roadmap_reminder.yml@fd4575466e5c2ac10703ac16f5aa9fb8890f532a
17-
with:
18-
token: ${{ github.token }}
14+
permissions:
15+
contents: read
16+
pull-requests: read
17+
issues: write # create monthly roadmap report
18+
19+
# setting to `@main` until we have releases and governance installed
20+
uses: aws-powertools/actions/.github/workflows/monthly_roadmap_reminder.yml@main
21+
secrets:
22+
token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/secure_workflows.yml

+3-1
Original file line numberDiff line numberDiff line change
@@ -34,4 +34,6 @@ jobs:
3434
- name: Ensure 3rd party workflows have SHA pinned
3535
uses: zgosalvez/github-actions-ensure-sha-pinned-actions@19ebcb0babbd282ae1822a0b9c28f3f1f25cea45 # v3.0.4
3636
with:
37-
allowlist: slsa-framework/slsa-github-generator
37+
allowlist: |
38+
slsa-framework/slsa-github-generator
39+
aws-powertools/actions

0 commit comments

Comments
 (0)