oscerd opened a new issue, #9059:
URL: https://github.com/apache/camel-quarkus/issues/9059
Neither `.github/workflows/camel-master-cron.yaml` nor
`.github/workflows/quarkus-master-cron.yaml` declares a `permissions:` block at
any level, so every job runs with the repository's default token scope.
These workflows build code cloned from another repository:
```yaml
- name: Clone Camel
run: |
cd ../
git clone --depth 1 --branch main https://github.com/apache/camel.git
- name: Build Camel
run: |
cd ../camel
./mvnw ${CQ_MAVEN_ARGS} clean install -Dquickly -T1C
```
and a later job pushes with `git push --force-with-lease origin camel-main`
using the checkout-persisted token.
**Suggested fix**
Add a top-level `permissions: contents: read` to both workflows, and grant
`contents: write` / `issues: write` only on the specific jobs that push
branches or comment on issues.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
