ci: fix expressions and permissions

.github/workflows/ci-build-linux.yml

@@ -182,7 +182,7 @@ jobs:
 
       - name: Prepare assets
         env:
-          SHOULD_BUILD_APPIMAGE: ${{ (vars[format('DISABLE_{0}_APPIMAGE', ((github.ref == 'refs/heads/insider' || (github.event_name == 'pull_request' && github.event.pull_request.base.ref == 'insider')) && 'INSIDER' || 'STABLE'))] == 'yes' && 'no' || 'yes' }}
+          SHOULD_BUILD_APPIMAGE: ${{ vars[format('DISABLE_{0}_APPIMAGE', ((github.ref == 'refs/heads/insider' || (github.event_name == 'pull_request' && github.event.pull_request.base.ref == 'insider')) && 'INSIDER' || 'STABLE'))] == 'yes' && 'no' || 'yes' }}
           SHOULD_BUILD_REH: 'no'
           SHOULD_BUILD_REH_WEB: 'no'
           VSCODE_SYSROOT_REPOSITORY: ${{ steps.build.outputs.VSCODE_SYSROOT_REPOSITORY }}

.github/workflows/ci-build-windows.yml

@@ -140,7 +140,7 @@ jobs:
 
       - name: Build
         env:
-          DISABLE_MSI: ${{ vars[format('DISABLE_{0}_MSI', ((github.ref == 'refs/heads/insider' || (github.event_name == 'pull_request' && github.event.pull_request.base.ref == 'insider')) && 'INSIDER' || 'STABLE')] }}
+          DISABLE_MSI: ${{ vars[format('DISABLE_{0}_MSI', ((github.ref == 'refs/heads/insider' || (github.event_name == 'pull_request' && github.event.pull_request.base.ref == 'insider')) && 'INSIDER' || 'STABLE'))] }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           npm_config_arch: ${{ matrix.vscode_arch }}
           npm_config_target_arch: ${{ matrix.vscode_arch }}

.github/workflows/publish-insider-linux.yml

@@ -1,7 +1,7 @@
 name: Publish - Insider - Linux
 
 on:
-  workflow_dispatch:
+  workflow_dispatch: {}
   repository_dispatch:
     types:
       - publish-insider
@@ -125,7 +125,8 @@ jobs:
       - compile
     runs-on: ubuntu-latest
     environment: publish
-    permissions: {}
+    permissions:
+      contents: write
     strategy:
       fail-fast: false
       matrix:
@@ -221,8 +222,6 @@ jobs:
         if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes' && env.SHOULD_DEPLOY == 'yes'
 
       - name: Release
-        permissions:
-          contents: write
         env:
           GITHUB_TOKEN: ${{ secrets.STRONGER_GITHUB_TOKEN }}
           GITHUB_USERNAME: ${{ github.repository_owner }}
@@ -242,7 +241,8 @@ jobs:
       - compile
     runs-on: ubuntu-22.04
     environment: publish
-    permissions: {}
+    permissions:
+      contents: write
     strategy:
       fail-fast: false
       matrix:
@@ -334,8 +334,6 @@ jobs:
         if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no')
 
       - name: Release
-        permissions:
-          contents: write
         env:
           GITHUB_TOKEN: ${{ secrets.STRONGER_GITHUB_TOKEN }}
           GITHUB_USERNAME: ${{ github.repository_owner }}
@@ -348,7 +346,8 @@ jobs:
       - compile
     runs-on: ubuntu-22.04
     environment: publish
-    permissions: {}
+    permissions:
+      contents: write
     strategy:
       fail-fast: false
       matrix:
@@ -416,8 +415,6 @@ jobs:
         if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no')
 
       - name: Release
-        permissions:
-          contents: write
         env:
           GITHUB_TOKEN: ${{ secrets.STRONGER_GITHUB_TOKEN }}
           GITHUB_USERNAME: ${{ github.repository_owner }}
@@ -460,7 +457,8 @@ jobs:
       - build
     runs-on: ubuntu-latest
     environment: publish
-    permissions: {}
+    permissions:
+      contents: write
     env:
       RELEASE_VERSION: ${{ needs.check.outputs.RELEASE_VERSION }}
       SNAP_NAME: codium-insiders
@@ -492,8 +490,6 @@ jobs:
       #     isClassic: 'true'
 
       - uses: svenstaro/upload-release-action@29e53e917877a24fad85510ded594ab3c9ca12de # latest
-        permissions:
-          contents: write
         with:
           repo_name: ${{ env.ASSETS_REPOSITORY }}
           repo_token: ${{ secrets.STRONGER_GITHUB_TOKEN }}

.github/workflows/publish-insider-macos.yml

@@ -1,7 +1,7 @@
 name: Publish - Insider - macOS
 
 on:
-  workflow_dispatch:
+  workflow_dispatch: {}
   repository_dispatch:
     types:
       - publish-insider
@@ -21,7 +21,8 @@ jobs:
   build:
     runs-on: ${{ matrix.runner }}
     environment: publish
-    permissions: {}
+    permissions:
+      contents: write
     env:
       SHOULD_BUILD: yes
       SHOULD_DEPLOY: yes

.github/workflows/publish-insider-windows.yml

@@ -1,7 +1,7 @@
 name: Publish - Insider - Windows
 
 on:
-  workflow_dispatch:
+  workflow_dispatch: {}
   repository_dispatch:
     types:
       - publish-insider
@@ -115,7 +115,8 @@ jobs:
       - compile
     runs-on: windows-2022
     environment: publish
-    permissions: {}
+    permissions:
+      contents: write
     strategy:
       fail-fast: false
       matrix:
@@ -229,7 +230,8 @@ jobs:
     needs: build
     runs-on: windows-2022
     environment: publish
-    permissions: {}
+    permissions:
+      contents: write
     defaults:
       run:
         shell: bash

.github/workflows/publish-stable-linux.yml

@@ -1,7 +1,7 @@
 name: Publish - Stable - Linux
 
 on:
-  workflow_dispatch:
+  workflow_dispatch: {}
   repository_dispatch:
     types:
       - publish-stable
@@ -126,7 +126,8 @@ jobs:
       - compile
     runs-on: ubuntu-latest
     environment: publish
-    permissions: {}
+    permissions:
+      contents: write
     strategy:
       fail-fast: false
       matrix:
@@ -222,8 +223,6 @@ jobs:
         if: env.DISABLED != 'yes' && env.SHOULD_BUILD == 'yes' && env.SHOULD_DEPLOY == 'yes'
 
       - name: Release
-        permissions:
-          contents: write
         env:
           GITHUB_TOKEN: ${{ secrets.STRONGER_GITHUB_TOKEN }}
           GITHUB_USERNAME: ${{ github.repository_owner }}
@@ -243,7 +242,8 @@ jobs:
       - compile
     runs-on: ubuntu-22.04
     environment: publish
-    permissions: {}
+    permissions:
+      contents: write
     strategy:
       fail-fast: false
       matrix:
@@ -335,8 +335,6 @@ jobs:
         if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no')
 
       - name: Release
-        permissions:
-          contents: write
         env:
           GITHUB_TOKEN: ${{ secrets.STRONGER_GITHUB_TOKEN }}
           GITHUB_USERNAME: ${{ github.repository_owner }}
@@ -349,7 +347,8 @@ jobs:
       - compile
     runs-on: ubuntu-22.04
     environment: publish
-    permissions: {}
+    permissions:
+      contents: write
     strategy:
       fail-fast: false
       matrix:
@@ -417,8 +416,6 @@ jobs:
         if: env.DISABLED != 'yes' && (env.SHOULD_BUILD_REH != 'no' || env.SHOULD_BUILD_REH_WEB != 'no')
 
       - name: Release
-        permissions:
-          contents: write
         env:
           GITHUB_TOKEN: ${{ secrets.STRONGER_GITHUB_TOKEN }}
           GITHUB_USERNAME: ${{ github.repository_owner }}

.github/workflows/publish-stable-macos.yml

@@ -1,7 +1,7 @@
 name: Publish - Stable - macOS
 
 on:
-  workflow_dispatch:
+  workflow_dispatch: {}
   repository_dispatch:
     types:
       - publish-stable
@@ -21,7 +21,8 @@ jobs:
   build:
     runs-on: ${{ matrix.runner }}
     environment: publish
-    permissions: {}
+    permissions:
+      contents: write
     env:
       SHOULD_BUILD: yes
       SHOULD_DEPLOY: yes

.github/workflows/publish-stable-windows.yml

@@ -1,7 +1,7 @@
 name: Publish - Stable - Windows
 
 on:
-  workflow_dispatch:
+  workflow_dispatch: {}
   repository_dispatch:
     types:
       - publish-stable
@@ -115,7 +115,8 @@ jobs:
       - compile
     runs-on: windows-2022
     environment: publish
-    permissions: {}
+    permissions:
+      contents: write
     strategy:
       fail-fast: false
       matrix:
@@ -228,7 +229,8 @@ jobs:
     needs: build
     runs-on: windows-2022
     environment: publish
-    permissions: {}
+    permissions:
+      contents: write
     defaults:
       run:
         shell: bash