fix permissions

dbt-labs · Oct 11, 2024 · d32fc1d · d32fc1d
1 parent 1ab969a
commit d32fc1d
Show file tree

Hide file tree

Showing 4 changed files with 11 additions and 11 deletions.
diff --git a/.github/workflows/code-quality.yml b/.github/workflows/code-quality.yml
@@ -22,6 +22,9 @@ on:
         type: string
         default: "dbt-labs/dbt-athena"
 
+permissions:
+  contents: read
+
 jobs:
   code-quality:
     runs-on: ubuntu-latest

diff --git a/.github/workflows/publish-pypi.yml b/.github/workflows/publish-pypi.yml
@@ -19,15 +19,6 @@ on:
 permissions:
   contents: read
 
-# don't attempt to release the same target in parallel
-concurrency:
-  group: ${{ github.workflow }}-${{ inputs.package }}-${{ inputs.deploy-to }}
-  cancel-in-progress: true
-
-defaults:
-  run:
-    shell: bash
-
 jobs:
   publish:
     runs-on: ubuntu-latest
@@ -49,6 +40,7 @@ jobs:
       # hatch will build using test PyPI first and fall back to prod PyPI when deploying to test
       # this is done via environment variables in the test environment in GitHub
       - run: hatch build && hatch run build:check-all
+        shell: bash
         working-directory: ./${{ inputs.package }}
       - uses: pypa/gh-action-pypi-publish@release/v1
         with:

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
@@ -12,8 +12,10 @@ on:
         type: string
         default: "main"
 
-permissions:
-  contents: read
+# don't attempt to release the same target in parallel
+concurrency:
+  group: ${{ github.workflow }}-${{ inputs.deploy-to }}
+  cancel-in-progress: true
 
 jobs:
   unit-tests:

diff --git a/.github/workflows/unit-tests.yml b/.github/workflows/unit-tests.yml
@@ -30,6 +30,9 @@ on:
         type: string
         default: "dbt-labs/dbt-athena"
 
+permissions:
+  contents: read
+
 jobs:
   unit-tests:
     runs-on: ubuntu-latest