contents:write for artifact upload, github releases

isl-org · Jun 3, 2024 · e7f6c2b · e7f6c2b
1 parent 8b74846
commit e7f6c2b
Show file tree

Hide file tree

Showing 8 changed files with 56 additions and 0 deletions.
diff --git a/.github/workflows/documentation.yml b/.github/workflows/documentation.yml
@@ -79,13 +79,17 @@ jobs:
           ccache -s
 
       - name: Upload docs
+        permissions:
+          contents: write
         uses: actions/upload-artifact@v4
         with:
           name: open3d_docs
           path: docs/_out/html
           if-no-files-found: error
 
       - name: Deploy docs if all artifacts available
+        permissions:
+          contents: write
         if: ${{ github.ref == 'refs/heads/main' }}
         env:
           GH_TOKEN: ${{ github.token }}

diff --git a/.github/workflows/macos.yml b/.github/workflows/macos.yml
@@ -113,6 +113,8 @@ jobs:
           ccache -s
 
       - name: Upload package
+        permissions:
+          contents: write
         if: ${{ env.BUILD_SHARED_LIBS == 'ON' }}
         uses: actions/upload-artifact@v4
         with:
@@ -121,6 +123,8 @@ jobs:
           if-no-files-found: error
 
       - name: Update package devel release
+        permissions:
+          contents: write
         if: ${{ github.ref == 'refs/heads/main' && env.BUILD_SHARED_LIBS == 'ON' }}
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -129,6 +133,8 @@ jobs:
           gh release view main-devel
 
       - name: Upload Open3D viewer app
+        permissions:
+          contents: write
         uses: actions/upload-artifact@v4
         if: ${{ env.BUILD_SHARED_LIBS == 'OFF' }}
         with:
@@ -163,13 +169,17 @@ jobs:
           zip -rv "${APP_NAME}" Open3D.app
 
       - name: Upload Open3D viewer app
+        permissions:
+          contents: write
         uses: actions/upload-artifact@v4
         with:
           name: open3d-app-macosx-10_15-universal2
           path: open3d-*-app-macosx-10_15-universal2.zip
           if-no-files-found: error
 
       - name: Update viewer devel release
+        permissions:
+          contents: write
         if: ${{ github.ref == 'refs/heads/main' }}
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -279,6 +289,8 @@ jobs:
           echo "PIP_PKG_NAME=$PIP_PKG_NAME" >> $GITHUB_ENV
 
       - name: Upload wheel
+        permissions:
+          contents: write
         uses: actions/upload-artifact@v4
         with:
           name: ${{ env.PIP_PKG_NAME }}
@@ -336,13 +348,17 @@ jobs:
           echo "PIP_PKG_NAME=$NEW_WHL_NAME" >> $GITHUB_ENV
 
       - name: Upload merged wheels
+        permissions:
+          contents: write
         uses: actions/upload-artifact@v4
         with:
           name: ${{ env.PIP_PKG_NAME }}
           path: universal_wheels/${{ env.PIP_PKG_NAME }}
           if-no-files-found: error
 
       - name: Update devel release
+        permissions:
+          contents: write
         if: ${{ github.ref == 'refs/heads/main' }}
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

diff --git a/.github/workflows/ubuntu-cuda.yml b/.github/workflows/ubuntu-cuda.yml
@@ -150,6 +150,8 @@ jobs:
           fi
 
       - name: Upload package
+        permissions:
+          contents: write
         if: ${{ env.BUILD_PACKAGE == 'true' }}
         uses: actions/upload-artifact@v4
         with:
@@ -158,6 +160,8 @@ jobs:
           if-no-files-found: error
 
       - name: Update devel release
+        permissions:
+          contents: write
         if: ${{ github.ref == 'refs/heads/main' && env.BUILD_PACKAGE == 'true' }}
         env:
           GH_TOKEN: ${{ github.token }}

diff --git a/.github/workflows/ubuntu-wheel.yml b/.github/workflows/ubuntu-wheel.yml
@@ -79,6 +79,8 @@ jobs:
           echo "PIP_PKG_NAME=$PIP_PKG_NAME" >> $GITHUB_ENV
           echo "PIP_CPU_PKG_NAME=$PIP_CPU_PKG_NAME" >> $GITHUB_ENV
       - name: Upload wheel to GitHub artifacts
+        permissions:
+          contents: write
         uses: actions/upload-artifact@v4
         with:
           name: ${{ env.PIP_PKG_NAME }}
@@ -103,6 +105,8 @@ jobs:
         run: |
           gsutil cp ${GITHUB_WORKSPACE}/${{ env.CCACHE_TAR_NAME }}.tar.gz gs://open3d-ci-cache/
       - name: Update devel release
+        permissions:
+          contents: write
         # if: ${{ github.ref == 'refs/heads/main' }}
         env:
           GH_TOKEN: ${{ github.token }}

diff --git a/.github/workflows/ubuntu.yml b/.github/workflows/ubuntu.yml
@@ -71,20 +71,26 @@ jobs:
             docker/docker_test.sh cpu-shared-ml-release
           fi
       - name: Upload package to GitHub artifacts
+        permissions:
+          contents: write
         if: ${{ env.BUILD_SHARED_LIBS == 'ON' }}
         uses: actions/upload-artifact@v4
         with:
           name: open3d-devel-linux-x86_64-ML_${{ matrix.MLOPS }}
           path: open3d-devel-*.tar.xz
           if-no-files-found: error
       - name: Upload viewer to GitHub artifacts
+        permissions:
+          contents: write
         if: ${{ env.BUILD_SHARED_LIBS == 'OFF' }}
         uses: actions/upload-artifact@v4
         with:
           name: open3d-viewer-Linux
           path: open3d-viewer-*-Linux.deb
           if-no-files-found: error
       - name: Update devel release
+        permissions:
+          contents: write
         if: ${{ github.ref == 'refs/heads/main' }}
         env:
           GH_TOKEN: ${{ github.token }}

diff --git a/.github/workflows/vtk_packages.yml b/.github/workflows/vtk_packages.yml
@@ -26,6 +26,8 @@ jobs:
           make -j$(nproc)
           cmake -E sha256sum vtk*.tar.gz > checksum_linux.txt
       - name: Upload artifacts
+        permissions:
+          contents: write
         uses: actions/upload-artifact@v4
         with:
           name: vtk_linux
@@ -76,6 +78,8 @@ jobs:
           ls
           cmake -E sha256sum (get-item vtk*.tar.gz).Name > checksum_win_${{matrix.configuration}}.txt
       - name: Upload package
+        permissions:
+          contents: write
         uses: actions/upload-artifact@v4
         with:
           name: vtk_windows_${{matrix.configuration}}
@@ -103,6 +107,8 @@ jobs:
           make -j2
           cmake -E sha256sum vtk*.tar.gz > checksum_macos.txt
       - name: Upload artifacts
+        permissions:
+          contents: write
         uses: actions/upload-artifact@v4
         with:
           name: vtk_macos

diff --git a/.github/workflows/webrtc.yml b/.github/workflows/webrtc.yml
@@ -62,6 +62,8 @@ jobs:
           build_webrtc
 
       - name: Upload WebRTC
+        permissions:
+          contents: write
         uses: actions/upload-artifact@v4
         with:
           name: webrtc_release_${{ matrix.os }}
@@ -168,6 +170,8 @@ jobs:
           cmake -E sha256sum webrtc_${env:WEBRTC_COMMIT_SHORT}_win.zip | Tee-Object -FilePath checksum_win.txt
 
       - name: Upload WebRTC
+        permissions:
+          contents: write
         uses: actions/upload-artifact@v4
         with:
           name: webrtc_release_windows

diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml
@@ -147,6 +147,8 @@ jobs:
             $env:GITHUB_ENV -Encoding utf8 -Append
 
       - name: Upload Package
+        permissions:
+          contents: write
         if: ${{ matrix.BUILD_SHARED_LIBS == 'ON' && matrix.BUILD_CUDA_MODULE == 'OFF' }}
         uses: actions/upload-artifact@v4
         with:
@@ -155,6 +157,8 @@ jobs:
           if-no-files-found: error
 
       - name: Update devel release with package
+        permissions:
+          contents: write
         if: ${{ github.ref == 'refs/heads/main' && matrix.BUILD_SHARED_LIBS == 'ON' && matrix.BUILD_CUDA_MODULE == 'OFF' }}
         env:
           GH_TOKEN: ${{ github.token }}
@@ -173,6 +177,8 @@ jobs:
             --target INSTALL
 
       - name: Upload Viewer
+        permissions:
+          contents: write
         if: ${{ matrix.BUILD_SHARED_LIBS == 'OFF' && matrix.STATIC_RUNTIME == 'ON' && matrix.BUILD_CUDA_MODULE == 'OFF' && matrix.CONFIG == 'Release' }}
         uses: actions/upload-artifact@v4
         with:
@@ -181,6 +187,8 @@ jobs:
           if-no-files-found: error
 
       - name: Update devel release with viewer
+        permissions:
+          contents: write
         if: ${{ github.ref == 'refs/heads/main' && matrix.BUILD_SHARED_LIBS == 'OFF' && matrix.STATIC_RUNTIME == 'ON' && matrix.BUILD_CUDA_MODULE == 'OFF' && matrix.CONFIG == 'Release' }}
         env:
           GH_TOKEN: ${{ github.token }}
@@ -302,13 +310,17 @@ jobs:
           echo "PIP_PKG_NAME=$PIP_PKG_NAME"  | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
 
       - name: Upload wheel
+        permissions:
+          contents: write
         uses: actions/upload-artifact@v4
         with:
           name: ${{ env.PIP_PKG_NAME }}
           path: ${{ env.BUILD_DIR }}/lib/python_package/pip_package/${{ env.PIP_PKG_NAME }}
           if-no-files-found: error
 
       - name: Update devel release with wheel
+        permissions:
+          contents: write
         if: ${{ github.ref == 'refs/heads/main' }}
         env:
           GH_TOKEN: ${{ github.token }}