ci: scope permissions and split jobs (#38)

trailofbits · May 16, 2024 · b7bbf3e · b7bbf3e
1 parent a390357
commit b7bbf3e
Showing 1 changed file with 27 additions and 12 deletions.
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
@@ -3,6 +3,9 @@ on:
     release:
         types: [published]
 
+permissions:
+    contents: read
+
 jobs:
     build:
         runs-on: ubuntu-latest
@@ -18,30 +21,42 @@ jobs:
 
             - uses: actions/upload-artifact@v4
               with:
-                  name: "weaudit"
-                  path: "weaudit.vsix"
+                  name: weaudit
+                  path: weaudit.vsix
 
-    publish:
+    upload-asset:
         runs-on: ubuntu-latest
         needs: build
         if: success()
+        permissions:
+            contents: write
         steps:
             - uses: actions/download-artifact@v4
               with:
-                  name: "weaudit"
-
-            # Uncomment the following lines to also publish the extension on the VSCode Marketplace
-            # - name: Publish Extension on VSCode's Marketplace
-            #   run: npx vsce publish --pat ${{ secrets.VSCODE_PUBLISHING_TOKEN }} --packagePath weaudit.vsix
-
-            - name: Publish Extension on OpenVSX
-              run: npx ovsx publish --pat ${{ secrets.WEAUDIT_OPENVSX_TOKEN }} --packagePath weaudit.vsix
+                  name: weaudit
 
             - name: Add vsix to the release assets
               uses: actions/upload-release-asset@v1.0.2
+              env:
+                  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
               with:
                   upload_url: ${{ github.event.release.upload_url }}
                   asset_path: weaudit.vsix
                   asset_name: weaudit.vsix
                   asset_content_type: application/octet-stream
-                  token: ${{ secrets.GITHUB_TOKEN }}
+
+    publish:
+        runs-on: ubuntu-latest
+        needs: build
+        if: success()
+        steps:
+            - uses: actions/download-artifact@v4
+              with:
+                  name: weaudit
+
+            # Uncomment the following lines to also publish the extension on the VSCode Marketplace
+            # - name: Publish Extension on VSCode's Marketplace
+            #   run: npx vsce publish --pat ${{ secrets.WEAUDIT_VSCODE_MARKETPLACE_TOKEN }} --packagePath weaudit.vsix
+
+            - name: Publish Extension on OpenVSX
+              run: npx ovsx publish --pat ${{ secrets.WEAUDIT_OPENVSX_TOKEN }} --packagePath weaudit.vsix