Files
neovim/.github/workflows/response.yml
Daniel Hast 755087f8ef ci: set default permissions for workflows
The default workflow permissions are overly broad; setting permissions
explicitly at the workflow level ensures excessive permissions are not
unintentionally granted to jobs. For details, see:
https://docs.zizmor.sh/audits/#excessive-permissions
2026-03-09 21:36:20 -04:00

44 lines
1.0 KiB
YAML

name: no_response
on:
schedule:
- cron: '30 1 * * *' # Run every day at 01:30
workflow_dispatch:
issue_comment:
permissions: {}
jobs:
close:
if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
runs-on: ubuntu-latest
permissions:
issues: write
pull-requests: write
steps:
- uses: actions/checkout@v6
with:
persist-credentials: false
- uses: actions/github-script@v8
with:
script: |
const script = require('./.github/scripts/close_unresponsive.js')
await script({github, context})
remove_label:
if: github.event_name == 'issue_comment'
runs-on: ubuntu-latest
permissions:
issues: write
pull-requests: write
steps:
- uses: actions/checkout@v6
with:
persist-credentials: false
- uses: actions/github-script@v8
with:
script: |
const script = require('./.github/scripts/remove_response_label.js')
await script({github, context})