try this

demergent-labs · Jan 27, 2025 · b7a9cee · b7a9cee
1 parent a70d23d
commit b7a9cee
Show file tree

Hide file tree

Showing 8 changed files with 21 additions and 102 deletions.
diff --git a/.github/actions/commit_and_push/action.yml b/.github/actions/commit_and_push/action.yml
@@ -11,20 +11,10 @@ inputs:
     commit-message:
         description: 'Commit message'
         required: true
-    gpg-signing-key:
-        description: 'The GPG signing key to use for signing commits'
-        required: true
-    signing-key-id:
-        description: 'The GPG signing key ID to configure for git'
-        required: true
+
 runs:
     using: composite
     steps:
-        - uses: ./.github/actions/configure_git
-          with:
-              gpg-signing-key: ${{ inputs.gpg-signing-key }}
-              signing-key-id: ${{ inputs.signing-key-id }}
-
         - name: Commit and push changes
           shell: bash
           run: |

diff --git a/.github/workflows/benchmark.yml b/.github/workflows/benchmark.yml
@@ -18,10 +18,6 @@ on:
                 required: true
                 type: boolean
                 default: false
-            signing-key-id:
-                required: true
-                type: string
-                default: C8B77BCBE16CD2B94B43F9C8757397B82D4ED7B0
     workflow_call:
         inputs:
             exclude-slow-benchmarks:
@@ -45,6 +41,8 @@ on:
             LASTMJS_GITHUB_TOKEN:
                 required: true
 
+permissions: write-all
+
 jobs:
     get-exclude-dirs:
         name: Get exclude directories
@@ -66,9 +64,6 @@ jobs:
         with:
             prefix: 'benchmark'
             version: $(jq -r '.version' package.json)
-            signing-key-id: ${{ inputs.signing-key-id }}
-        secrets:
-            GPG_SIGNING_KEY: ${{ secrets.GPG_SIGNING_KEY }}
 
     run-benchmarks:
         name: ${{ matrix.benchmark_group.name }}
@@ -113,15 +108,12 @@ jobs:
                       }
         uses: ./.github/workflows/benchmark_parallel.yml
         secrets:
-            GPG_SIGNING_KEY: ${{ secrets.GPG_SIGNING_KEY }}
             GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-            LASTMJS_GITHUB_TOKEN: ${{ secrets.LASTMJS_GITHUB_TOKEN }}
         with:
             base-branch: ${{ needs.create-branch-prefix.outputs.base-branch }}
             branch-prefix: ${{ needs.create-branch-prefix.outputs.branch-prefix }}
             directories: ${{ matrix.benchmark_group.directories }}
             exclude-dirs: ${{ needs.get-exclude-dirs.outputs.exclude-dirs }}
-            signing-key-id: ${{ inputs.signing-key-id }}
 
     squash-branches:
         needs: [run-benchmarks, create-branch-prefix]
@@ -130,11 +122,8 @@ jobs:
             base-branch: ${{ needs.create-branch-prefix.outputs.base-branch }}
             branch-prefix: ${{ needs.create-branch-prefix.outputs.branch-prefix }}
             commit-message: 'run benchmarks'
-            signing-key-id: ${{ inputs.signing-key-id }}
         secrets:
-            GPG_SIGNING_KEY: ${{ secrets.GPG_SIGNING_KEY }}
             GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-            LASTMJS_GITHUB_TOKEN: ${{ secrets.LASTMJS_GITHUB_TOKEN }}
 
     analyze-benchmarks:
         name: Analyze Benchmark Results
@@ -160,11 +149,9 @@ jobs:
 
             - uses: ./.github/actions/commit_and_push
               with:
-                  gpg-signing-key: ${{ secrets.GPG_SIGNING_KEY }}
                   branch-name: ${{ needs.create-branch-prefix.outputs.base-branch }}
                   commit-message: 'analyze benchmark results'
                   create-branch: 'false'
-                  signing-key-id: ${{ inputs.signing-key-id }}
 
     create-pr:
         needs:
@@ -178,7 +165,7 @@ jobs:
 
             - name: Create Pull Request
               env:
-                  GH_TOKEN: ${{ secrets.LASTMJS_GITHUB_TOKEN }}
+                  GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
               run: |
                   gh pr create \
                     --base main \

diff --git a/.github/workflows/benchmark_parallel.yml b/.github/workflows/benchmark_parallel.yml
@@ -15,18 +15,12 @@ on:
                 required: false
                 type: string
                 default: ''
-            signing-key-id:
-                required: true
-                type: string
-                description: 'Signing key ID to use for signing commits'
 
         secrets:
-            GPG_SIGNING_KEY:
-                required: true
             GH_TOKEN:
                 required: true
-            LASTMJS_GITHUB_TOKEN:
-                required: true
+
+permissions: write-all
 
 jobs:
     prepare-benchmark:
@@ -66,7 +60,7 @@ jobs:
             - uses: actions/checkout@v4
               with:
                   ref: ${{ inputs.base-branch }}
-                  token: ${{ secrets.LASTMJS_GITHUB_TOKEN }}
+                  token: ${{ secrets.GITHUB_TOKEN }}
 
             - name: Report full path of test
               # Just in case the path isn't obvious from the name, this will remove ambiguity
@@ -128,6 +122,4 @@ jobs:
               with:
                   branch-name: ${{ steps.create-branch-name.outputs.branch-name }}
                   commit-message: 'Run benchmarks for ${{ matrix.test.displayPath }}'
-                  gpg-signing-key: ${{ secrets.GPG_SIGNING_KEY }}
                   create-branch: 'true'
-                  signing-key-id: ${{ inputs.signing-key-id }}
diff --git a/.github/workflows/build_templates.yml b/.github/workflows/build_templates.yml
@@ -8,6 +8,8 @@ on:
             - ready_for_review
             - reopened
 
+permissions: write-all
+
 jobs:
     workflow-config:
         name: Determine workflow config
@@ -35,7 +37,7 @@ jobs:
             - uses: actions/checkout@v4
               with:
                   ref: ${{ github.head_ref }}
-                  token: ${{ secrets.LASTMJS_GITHUB_TOKEN }}
+                  token: ${{ secrets.GITHUB_TOKEN }}
 
             - uses: ./.github/actions/setup_node
 
@@ -59,5 +61,3 @@ jobs:
               with:
                   branch-name: ${{ github.head_ref }}
                   commit-message: 'chore: update templates for dependency changes'
-                  gpg-signing-key: ${{ secrets.GPG_SIGNING_KEY }}
-                  signing-key-id: ${{ needs.workflow-config.outputs.is-dependabot == 'true' && '2ED5FB11C6D5168EB9D69C5EF524010C7419CA66' || 'C8B77BCBE16CD2B94B43F9C8757397B82D4ED7B0' }}
diff --git a/.github/workflows/create_branch_prefix.yml b/.github/workflows/create_branch_prefix.yml
@@ -10,20 +10,15 @@ on:
                 required: true
                 type: string
                 description: 'Version to use in branch names'
-            signing-key-id:
-                required: true
-                type: string
-                description: 'Signing key ID to use for signing commits'
         outputs:
             branch-prefix:
                 description: 'The generated branch prefix ({prefix}--{version}-)'
                 value: ${{ jobs.create-branch-prefix.outputs.branch-prefix }}
             base-branch:
                 description: 'The generated base branch name ({prefix}--{version})'
                 value: ${{ jobs.create-branch-prefix.outputs.base-branch }}
-        secrets:
-            GPG_SIGNING_KEY:
-                required: true
+
+permissions: write-all
 
 jobs:
     create-branch-prefix:
@@ -44,11 +39,6 @@ jobs:
                   echo "branch-prefix=${{ inputs.prefix }}--$VERSION--" >> $GITHUB_OUTPUT
                   echo "base-branch=${{ inputs.prefix }}--$VERSION" >> $GITHUB_OUTPUT
 
-            - uses: ./.github/actions/configure_git
-              with:
-                  gpg-signing-key: ${{ secrets.GPG_SIGNING_KEY }}
-                  signing-key-id: ${{ inputs.signing-key-id }}
-
             - name: Create base branch
               run: git checkout -b ${{ steps.create-prefix.outputs.base-branch }}
 

diff --git a/.github/workflows/maintenance.yml b/.github/workflows/maintenance.yml
@@ -5,6 +5,8 @@ on:
         # Run at 10:00 UTC (4:00 AM MT) every day
         - cron: '0 10 * * *'
 
+permissions: write-all
+
 jobs:
     determine-signing-key:
         runs-on: ubuntu-latest
@@ -30,9 +32,6 @@ jobs:
         with:
             prefix: ${{ needs.determine-prefix.outputs.prefix }}
             version: $(jq -r '.version' package.json)
-            signing-key-id: ${{ needs.determine-signing-key.outputs.signing-key-id }}
-        secrets:
-            GPG_SIGNING_KEY: ${{ secrets.GPG_SIGNING_KEY }}
 
     prepare-maintenance:
         name: Prepare Maintenance
@@ -46,7 +45,6 @@ jobs:
             - uses: actions/checkout@v4
               with:
                   ref: ${{ needs.create-branch-prefix.outputs.base-branch }}
-                  token: ${{ secrets.LASTMJS_GITHUB_TOKEN }}
 
             - uses: ./.github/actions/setup_node
 
@@ -67,8 +65,6 @@ jobs:
               with:
                   branch-name: ${{ needs.create-branch-prefix.outputs.base-branch }}
                   commit-message: 'Example/test maintenance: formatting and linting'
-                  gpg-signing-key: ${{ secrets.GPG_SIGNING_KEY }}
-                  signing-key-id: ${{ needs.determine-signing-key.outputs.signing-key-id }}
 
             - id: get-test-infos
               uses: ./.github/actions/get_test_infos
@@ -93,7 +89,6 @@ jobs:
             - uses: actions/checkout@v4
               with:
                   ref: ${{ needs.create-branch-prefix.outputs.base-branch }}
-                  token: ${{ secrets.LASTMJS_GITHUB_TOKEN }}
 
             - uses: ./.github/actions/setup_node
 
@@ -117,9 +112,7 @@ jobs:
               with:
                   branch-name: ${{ steps.create-branch-name.outputs.branch-name }}
                   commit-message: 'Example/test maintenance: update dependencies'
-                  gpg-signing-key: ${{ secrets.GPG_SIGNING_KEY }}
                   create-branch: 'true'
-                  signing-key-id: ${{ needs.determine-signing-key.outputs.signing-key-id }}
 
     squash-branches:
         needs:
@@ -131,11 +124,6 @@ jobs:
             base-branch: ${{ needs.create-branch-prefix.outputs.base-branch }}
             branch-prefix: ${{ needs.create-branch-prefix.outputs.branch-prefix }}
             commit-message: 'Example/test maintenance: update dependencies'
-            signing-key-id: ${{ needs.determine-signing-key.outputs.signing-key-id }}
-        secrets:
-            GPG_SIGNING_KEY: ${{ secrets.GPG_SIGNING_KEY }}
-            GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-            LASTMJS_GITHUB_TOKEN: ${{ secrets.LASTMJS_GITHUB_TOKEN }}
 
     create-pr:
         needs:
@@ -163,7 +151,7 @@ jobs:
             - name: Create Pull Request
               if: steps.check-diff.outputs.has_changes == 'true'
               env:
-                  GH_TOKEN: ${{ secrets.LASTMJS_GITHUB_TOKEN }}
+                  GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
               run: |
                   gh pr create \
                     --base main \

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -9,23 +9,21 @@ on:
                 type: string
                 default: C8B77BCBE16CD2B94B43F9C8757397B82D4ED7B0
 
+permissions: write-all
+
 jobs:
     create-branch-prefix:
         uses: ./.github/workflows/create_branch_prefix.yml
         with:
             prefix: 'release'
             version: ${{ inputs.release-version }}
-            signing-key-id: ${{ inputs.signing-key-id }}
-        secrets:
-            GPG_SIGNING_KEY: ${{ secrets.GPG_SIGNING_KEY }}
 
     prepare-release:
         name: Prepare Release
         needs:
             - create-branch-prefix
         runs-on: ubuntu-latest
         env:
-            GPG_SIGNING_KEY: ${{ secrets.GPG_SIGNING_KEY }} # All commits must be verified
             GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         outputs:
             release-version: ${{ inputs.release-version }}
@@ -34,7 +32,6 @@ jobs:
             - uses: actions/checkout@v4
               with:
                   ref: ${{ needs.create-branch-prefix.outputs.base-branch }}
-                  token: ${{ secrets.LASTMJS_GITHUB_TOKEN }}
 
             - uses: ./.github/actions/setup_node
               with:
@@ -71,8 +68,6 @@ jobs:
               with:
                   branch-name: ${{ needs.create-branch-prefix.outputs.base-branch }}
                   commit-message: 'Prepare release ${{ inputs.release-version }}'
-                  gpg-signing-key: ${{ secrets.GPG_SIGNING_KEY }}
-                  signing-key-id: ${{ inputs.signing-key-id }}
 
             - name: Publish to npm
               run: |
@@ -104,7 +99,6 @@ jobs:
             - uses: actions/checkout@v4
               with:
                   ref: ${{ needs.create-branch-prefix.outputs.base-branch }}
-                  token: ${{ secrets.LASTMJS_GITHUB_TOKEN }}
 
             - uses: ./.github/actions/setup_node
 
@@ -144,9 +138,7 @@ jobs:
               with:
                   branch-name: ${{ steps.create-branch-name.outputs.branch-name }}
                   commit-message: 'Update test files for ${{ matrix.test.displayPath }}'
-                  gpg-signing-key: ${{ secrets.GPG_SIGNING_KEY }}
                   create-branch: 'true'
-                  signing-key-id: ${{ inputs.signing-key-id }}
 
     squash-branches:
         needs:
@@ -158,11 +150,6 @@ jobs:
             base-branch: ${{ needs.create-branch-prefix.outputs.base-branch }}
             branch-prefix: ${{ needs.create-branch-prefix.outputs.branch-prefix }}
             commit-message: 'Update test files for all tests and examples ${{ inputs.release-version }}'
-            signing-key-id: ${{ inputs.signing-key-id }}
-        secrets:
-            GPG_SIGNING_KEY: ${{ secrets.GPG_SIGNING_KEY }}
-            GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-            LASTMJS_GITHUB_TOKEN: ${{ secrets.LASTMJS_GITHUB_TOKEN }}
 
     create-release:
         needs:
@@ -174,7 +161,6 @@ jobs:
             - uses: actions/checkout@v4
               with:
                   ref: ${{ github.ref }}
-                  token: ${{ secrets.LASTMJS_GITHUB_TOKEN }}
 
             - name: Create release
               env:
@@ -202,8 +188,6 @@ jobs:
                   ref: ${{ github.ref }}
 
             - name: Create Pull Request
-              env:
-                  GH_TOKEN: ${{ secrets.LASTMJS_GITHUB_TOKEN }}
               run: |
                   gh pr create \
                     --base main \