23727993031
26%

Ran 30 Mar 2026 04:33AM UTC

Jobs 1

Files 205

Run time 1min

Badge

Embed ▾

Committed 30 Mar 2026 04:30AM UTC coverage: 24.298%. Remained the same

Build # 23727993031

Build Type

push

github

Committed by

web-flow

Commit Message

ci: add least-privilege permissions to GitHub Actions workflows (#6544)

* ci: add least-privilege permissions to GitHub Actions workflows

Remove unused code-review workflow (oilbeater/smart-review pinned to
mutable @main branch). Add explicit permissions blocks to the remaining
12 workflows that were relying on default (read-write) token scope,
reducing the supply chain attack surface. Add top-level permissions: {}
to gc-cache and release-chart which already had job-level declarations.

Signed-off-by: Mengxin Liu <liumengxinfly@gmail.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Mengxin Liu <liumengxinfly@gmail.com>

* ci: add packages:read permission for GHCR image pulls

The E2E jobs in build-x86-image.yaml use GITHUB_TOKEN to authenticate
with ghcr.io for pulling kindest-node images. Without packages:read,
the token has no GHCR access, causing "denied" errors on docker pull.

Signed-off-by: Mengxin Liu <liumengxinfly@gmail.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Mengxin Liu <liumengxinfly@gmail.com>

---------

Signed-off-by: Mengxin Liu <liumengxinfly@gmail.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Coverage Stats

13534 of 55700 relevant lines covered (24.3%)

0.28 hits per line

Jobs

ID	Job ID	Ran	Files	Coverage
1	23727993031.1	30 Mar 2026 04:33AM UTC	205	24.3	GitHub Action Run

kubeovn / kube-ovn / 23727993031
26%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Jobs

Source Files on build 23727993031

kubeovn / kube-ovn / 23727993031 26%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Jobs

Source Files on build 23727993031

kubeovn / kube-ovn / 23727993031
26%

README BADGES
x