Merge branch 'master' into cleanup-nightly-tps-workflow

Author: THardy98

.github/workflows/ci.yml

@@ -5,6 +5,9 @@ on:
     branches:
       - master
 
+permissions:
+  contents: read
+
 jobs:
   build-and-test:
     strategy:
@@ -23,6 +26,10 @@ jobs:
             runsOn: macos-15-intel
           - os: macos-arm
             runsOn: macos-14
+    permissions:
+      contents: read
+      checks: write
+      statuses: write
     runs-on: ${{ matrix.runsOn || matrix.os }}
     steps:
       - name: Checkout repository

.github/workflows/nightly-throughput-stress.yml

@@ -27,7 +27,7 @@ on:
         type: number
 
 permissions:
-    contents: read
+  contents: read
 
 env:
   # Workflow configuration
@@ -46,6 +46,9 @@ jobs:
   throughput-stress:
     runs-on: ubuntu-latest-4-cores
     timeout-minutes: ${{ fromJSON(inputs.job_timeout_minutes || (vars.NIGHTLY_JOB_TIMEOUT_MINUTES || '360')) }}
+    permissions:
+      contents: read
+      actions: write
 
     steps:
       - name: Print test configuration
@@ -149,4 +152,4 @@ jobs:
               ]
             }
         env:
-          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_SDK_ALERTS_WEBHOOK }}
+          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_SDK_ALERTS_WEBHOOK }}

.github/workflows/omes.yml

@@ -4,8 +4,14 @@ on:
     branches:
       - master
 
+permissions:
+  contents: read
+
 jobs:
   omes-image-build:
+    permissions:
+      contents: read
+      packages: write
     uses: temporalio/omes/.github/workflows/docker-images.yml@main
     secrets: inherit
     with:
@@ -14,4 +20,4 @@ jobs:
       sdk-repo-ref: ${{ github.event.pull_request.head.ref || github.ref }}
       # TODO: Remove once we have a good way of cleaning up sha-based pushed images
       docker-tag-ext: ci-latest
-      do-push: true
+      do-push: true

contrib/envconfig/client_config_load.go

@@ -32,7 +32,7 @@ func LoadDefaultClientOptions() (client.Options, error) {
 // LoadClientOptionsRequest are options for [LoadClientOptions].
 type LoadClientOptionsRequest struct {
 	// Override the file path to use to load the TOML file for config. Defaults to TEMPORAL_CONFIG_FILE environment
-	// variable or if that is unset/empty, defaults to [os.UserConfigDir]/temporal/temporal.toml. If ConfigFileData is
+	// variable or if that is unset/empty, defaults to [os.UserConfigDir]/temporalio/temporal.toml. If ConfigFileData is
 	// set, this cannot be set and no file loading from disk occurs. Ignored if DisableFile is true.
 	ConfigFilePath string
 
@@ -93,7 +93,7 @@ func LoadClientOptions(options LoadClientOptionsRequest) (client.Options, error)
 // [LoadClientConfigOptions] are options for [LoadClientConfig].
 type LoadClientConfigOptions struct {
 	// Override the file path to use to load the TOML file for config. Defaults to TEMPORAL_CONFIG_FILE environment
-	// variable or if that is unset/empty, defaults to [os.UserConfigDir]/temporal/temporal.toml. If ConfigFileData is
+	// variable or if that is unset/empty, defaults to [os.UserConfigDir]/temporalio/temporal.toml. If ConfigFileData is
 	// set, this cannot be set and no file loading from disk occurs.
 	ConfigFilePath string
 
@@ -158,7 +158,7 @@ func LoadClientConfig(options LoadClientConfigOptions) (ClientConfig, error) {
 // LoadClientConfigProfileOptions are options for [LoadClientConfigProfile].
 type LoadClientConfigProfileOptions struct {
 	// Override the file path to use to load the TOML file for config. Defaults to TEMPORAL_CONFIG_FILE environment
-	// variable or if that is unset/empty, defaults to [os.UserConfigDir]/temporal/temporal.toml. If ConfigFileData is
+	// variable or if that is unset/empty, defaults to [os.UserConfigDir]/temporalio/temporal.toml. If ConfigFileData is
 	// set, this cannot be set and no file loading from disk occurs. Ignored if DisableFile is true.
 	ConfigFilePath string
 
@@ -248,7 +248,7 @@ func LoadClientConfigProfile(options LoadClientConfigProfileOptions) (ClientConf
 // DefaultConfigFileProfile is the default profile used.
 const DefaultConfigFileProfile = "default"
 
-// DefaultConfigFilePath is the default config file path used. It is [os.UserConfigDir]/temporal/temporal.toml.
+// DefaultConfigFilePath is the default config file path used. It is [os.UserConfigDir]/temporalio/temporal.toml.
 //
 // WARNING: Environment configuration is currently experimental.
 func DefaultConfigFilePath() (string, error) {