mirror of
https://github.com/vee1e/tflite-micro.git
synced 2026-09-03 02:37:36 +00:00
5fa112687b
Pins the default GITHUB_TOKEN to contents: read on the workflows in .github/workflows/ that don't call a GitHub API beyond the initial checkout. The other workflows in this directory are left implicit because they need write scopes that a maintainer is better placed to declare. Motivation: CVE-2025-30066 (March 2025 tj-actions/changed-files compromise) exfiltrated GITHUB_TOKEN from workflow logs. Per-workflow caps bound runtime authority irrespective of repo or org default, give drift protection if the default ever widens, and are credited per-file by the OpenSSF Scorecard Token-Permissions check. YAML validated locally with yaml.safe_load. Signed-off-by: Arpit Jain <arpitjain099@gmail.com>
64 lines
1.6 KiB
YAML
64 lines
1.6 KiB
YAML
name: Merge Queue
|
|
|
|
# Entry point for GitHub Merge Queue. Runs all tests before merging.
|
|
|
|
on:
|
|
merge_group:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
call-core:
|
|
uses: ./.github/workflows/suite_core.yml
|
|
with:
|
|
trigger-sha: ${{ github.sha }}
|
|
secrets:
|
|
tflm-bot-token: ${{ secrets.TFLM_BOT_PACKAGE_READ_TOKEN }}
|
|
|
|
call-windows:
|
|
uses: ./.github/workflows/test_windows.yml
|
|
with:
|
|
trigger-sha: ${{ github.sha }}
|
|
|
|
call-cortex-m:
|
|
uses: ./.github/workflows/suite_cortex_m.yml
|
|
with:
|
|
trigger-sha: ${{ github.sha }}
|
|
scope: 'all'
|
|
secrets:
|
|
tflm-bot-token: ${{ secrets.TFLM_BOT_PACKAGE_READ_TOKEN }}
|
|
|
|
call-xtensa:
|
|
uses: ./.github/workflows/suite_xtensa.yml
|
|
with:
|
|
trigger-sha: ${{ github.sha }}
|
|
scope: 'all'
|
|
secrets:
|
|
tflm-bot-token: ${{ secrets.TFLM_BOT_PACKAGE_READ_TOKEN }}
|
|
|
|
call-hexagon:
|
|
uses: ./.github/workflows/suite_hexagon.yml
|
|
with:
|
|
trigger-sha: ${{ github.sha }}
|
|
secrets:
|
|
tflm-bot-token: ${{ secrets.TFLM_BOT_PACKAGE_READ_TOKEN }}
|
|
|
|
call-riscv:
|
|
uses: ./.github/workflows/suite_riscv.yml
|
|
with:
|
|
trigger-sha: ${{ github.sha }}
|
|
secrets:
|
|
tflm-bot-token: ${{ secrets.TFLM_BOT_PACKAGE_READ_TOKEN }}
|
|
|
|
tests-passed:
|
|
needs: [call-core, call-windows, call-cortex-m, call-xtensa, call-hexagon, call-riscv]
|
|
if: always()
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- run: |
|
|
if [[ "${{ contains(needs.*.result, 'failure') }}" == "true" || "${{ contains(needs.*.result, 'cancelled') }}" == "true" ]]; then
|
|
echo "One or more dependent jobs failed."
|
|
exit 1
|
|
fi
|
|
exit 0
|