document permissions

[tjenkinson]

It's possible to customise the GITHUB_TOKEN permissions now. Would be great to document which permissions this action needs.

I think it might be just

permissions:
  - actions: write

?

[mikehardy]

It needs actions read as well, at least https://docs.github.com/en/rest/reference/permissions-required-for-github-apps#permission-on-actions

have you tried it with a restricted token? would be interesting to see if actions read/write really was sufficient - then I'm sure a PR to the docs could work, @styfle has merged everything reasonable I've seen get proposed based on my last look through here while integrating it :-)

[styfle]

I had more documentation earlier but I removed it for some reason, I can't remember why 🤔

https://github.com/styfle/cancel-workflow-action/blob/1ec9f13909cd1e75b4dab50f5491b45c70579fa6/README.md#usage

[mikehardy]

probably because between then and now actions got access to the default token by putting it in the action.yaml so users were spared having to specify it. This is orthogonal though I think - it's about restricting that token to just the two perms of actions read/write and removing all the rest, which would be a nice way to reduce security surface area

[tjenkinson]

It needs actions read as well, at least https://docs.github.com/en/rest/reference/permissions-required-for-github-apps#permission-on-actions

Yeh I think write includes read. Haven’t tried it yet (ref video-dev/hls.js#3874) but will report back if it works

[tjenkinson]

Looks like it worked. No errors in logs

[adrienbernede]

I have been using it with apparent success in our project:
https://github.com/mfem/mfem/blob/c4d3610cb2e60501a9209eac2031453c9bb97383/.github/workflows/builds-and-tests.yml#L76

Being able to control the permission was the trigger to use this. Seeing this in documentation would be great. Thanks for this thread!

[styfle]

Great, feel free to submit a PR to update the README 👍