Skip to content

CI: read-only workflow token, write only for the release job - #36

Open
ApolloF wants to merge 1 commit into
mainfrom
ApolloF/a1-steroidtracker-ci
Open

ApolloF wants to merge 1 commit into
mainfrom
ApolloF/a1-steroidtracker-ci

Conversation

@ApolloF

@ApolloF ApolloF commented Nov 1, 2026

Copy link
Copy Markdown
Owner

The workflow had contents: write at the top, so every PR and Dependabot run got a write token. Now the top level is read-only and only release (tags) asks for write, which is what gh release create needs. Nothing else in the workflow used the token.

While I was in there I looked at where the CI time goes: a build run that touches app code takes 26-30 min and 24 of those are the two Robolectric suites, which run one JVM at a time on purpose (side by side they missed their 30 s waits). The only lever left is a second runner for the play suite, that would be a separate PR. The one red smoke run in the last 20 was the Compose timeout #34 fixed.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant