Skip to content

Conversation

@KSerrania
Copy link
Contributor

@KSerrania KSerrania commented Dec 10, 2025

What does this PR do?

Improves the pr-quick-check.yml reusable workflow with the following:

  • removes secrets: inherit from the initial call to the workflow, as no secrets are used in the pr-quick-check workflow,
  • splits the workflow into multiple job, each job having its own set of appropriate permissions.

Note: Since this workflow is called by a pull_request_target workflow, the changes cannot be tested before landing on master. Once this is merged, we should very carefully review runs of the pr-check workflow and verify that nothing broke.

Motivation

Better follow the principle of least privileges in GitHub Actions (task).

Review checklist (to be filled by reviewers)

  • Feature or bugfix MUST have appropriate tests (unit, integration, e2e)
  • Add the qa/skip-qa label if the PR doesn't need to be tested during QA.
  • If you need to backport this PR to another branch, you can add the backport/<branch-name> label to the PR and it will automatically open a backport PR once this one is merged

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants