workflows: improvements

.github/dependabot.yml

@@ -0,0 +1,21 @@
+version: 2
+updates:
+  # GitHub Actions
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    labels:
+      - "dependencies"
+      - "github-actions"
+    open-pull-requests-limit: 10
+
+  # Python dependencies via pip
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    labels:
+      - "dependencies"
+      - "python"
+    open-pull-requests-limit: 10

.github/workflows/ci.yaml

@@ -9,6 +9,9 @@ on:
       - main
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   build:
 

.github/workflows/discord_issue.yaml

@@ -4,8 +4,13 @@ on:
     types:
      - opened
      - closed
+
+permissions:
+  issues: read
+
 jobs:
   notify:
+    if: github.repository_owner == 'novem-code'
     runs-on: ubuntu-latest
     steps:
       - name: Send issue notification to Discord
@@ -33,7 +38,7 @@ jobs:
             --arg url "$ISSUE_URL" \
             --arg icon "<:devissue:1275356587946545172>" \
             --arg action "$ACTION_TEXT" \
-            '{content: "\($icon) \($repo) > [Issue #\($number): \($title)](\($url)) \($action)"}')
+            '{content: "\($icon) \($repo) > [Issue #\($number): \($title)](<\($url)>) \($action)"}')
           # Send the notification to Discord
           curl -H "Content-Type: application/json" \
             -X POST \

.github/workflows/discord_pr.yml

@@ -7,8 +7,12 @@ on:
      # - synchronize
      - closed
 
+permissions:
+  pull-requests: read
+
 jobs:
   notify:
+    if: github.repository_owner == 'novem-code'
     uses: novem-code/github-actions/.github/workflows/discord_pr.yml@main
     with:
       pr_title: ${{ github.event.pull_request.title }}

.github/workflows/discord_push.yml

@@ -5,9 +5,12 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 jobs:
   notify_push:
-    if: github.ref == 'refs/heads/main' && github.event_name == 'push' && !startsWith(github.event.head_commit.message, 'Merge pull request')
+    if: github.repository_owner == 'novem-code' && github.ref == 'refs/heads/main' && github.event_name == 'push' && !startsWith(github.event.head_commit.message, 'Merge pull request')
     uses: novem-code/github-actions/.github/workflows/discord_push.yml@v1
     with:
       branch_name: 'main'

.github/workflows/nix-build.yml

@@ -5,6 +5,9 @@ on:
     branches: [ "main" ]
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   check:
     name: "Nix Checks"

.github/workflows/python-publish.yml

@@ -104,7 +104,7 @@ jobs:
       uses: pypa/gh-action-pypi-publish@release/v1
 
     - name: Send release notification to Discord
-      if: success()
+      if: success() && github.repository_owner == 'novem-code'
       env:
         RELEASE_NAME: ${{ github.event.release.name }}
         RELEASE_TAG: ${{ github.event.release.tag_name }}
@@ -119,7 +119,7 @@ jobs:
           --arg name "$RELEASE_NAME" \
           --arg url "$RELEASE_URL" \
           --arg icon "🚀" \
-          '{content: "\($icon) \($repo) > [\($tag): \($name)](\($url)) has been released!"}')
+          '{content: "\($icon) \($repo) > [\($tag): \($name)](<\($url)>) has been released!"}')
         curl -H "Content-Type: application/json" \
           -X POST \
           -d "$MESSAGE" \