Skip to content

Add more permissions #26

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
kevinbackhouse merged 3 commits into from
Oct 23, 2025
Merged

Add more permissions #26

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
62ceab8
Add more permissions
kevinbackhouse Oct 21, 2025
6658c66
Checkout pull request branch
kevinbackhouse Oct 22, 2025
22e6d55
Allow workflow to run on branches that are behind main.
kevinbackhouse Oct 23, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 11 additions & 3 deletions .github/workflows/smoketest.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,9 +4,14 @@ on:
issue_comment:
types: [created] # Add "smoke test" as a PR comment to trigger this workflow.

# Permissions needed for reacting and adding comments for IssueOps commands
# See: https://github.com/github/branch-deploy/blob/48285b12b35e47e2dde0c27d2abb33daa846d98b/README.md?plain=1#L189-L197
permissions:
contents: read
pull-requests: write # For adding a reaction to the comment
pull-requests: write # Required for commenting on PRs
deployments: write # Required for updating deployment statuses
contents: write # Required for reading/writing the lock file
Copy link

Copilot AI Oct 21, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[nitpick] The comment states 'reading/writing' but the permission is 'write'. Consider clarifying that 'write' permission includes read access, or simplify to 'Required for writing the lock file' to match the permission level.

Suggested change
contents: write # Required for reading/writing the lock file
contents: write # Required for writing the lock file

Copilot uses AI. Check for mistakes.
Copy link
Contributor

@JarLob JarLob Oct 22, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This makes me wonder if we really need the workflow. On one hand it is carefully reviewed IssueOps, on the other hand it is a potentially untrusted code running with high privileges...

Copy link
Contributor

@m-y-mo m-y-mo Oct 22, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Or trigger it only on release or push instead of issue comment? The tests are running on the base code and not head anyway, so I don't see why it should be on issue comment. And if it runs on head then we definitely need to restrict it. It's not very clear to me when we want to run this workflow.

Copy link
Collaborator Author

@kevinbackhouse kevinbackhouse Oct 22, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The idea is that the branch-deploy action makes this safe to trigger with an issue comment. It's the solution that we've been recommending to other open source maintainers.

I intended this to run on the code from the PR, not the base code. That was a mistake.

Copy link
Contributor

@JarLob JarLob Oct 22, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good catch, I didn't notice it checkouts the main instead of steps.branch-deploy.outputs.sha. @kevinbackhouse could you remind us what is the purpose of the workflow?

Copy link
Collaborator Author

@kevinbackhouse kevinbackhouse Oct 22, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's for testing that the examples still work. It needs the COPILOT_TOKEN secret so a standard pull-request trigger doesn't work. I figure we could run it on-demand by adding a comment to a PR.

Copy link
Collaborator Author

@kevinbackhouse kevinbackhouse Oct 22, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I've updated it to use github.head_ref.

checks: read # Required for checking if the CI checks have passed in order to deploy the PR
statuses: read # Required for checking if all commit statuses are "success" in order to deploy the PR

jobs:
Linux:
Expand All @@ -19,14 +24,17 @@ jobs:
trigger: "smoke test"
reaction: "eyes"
stable_branch: "main"
update_branch: "disable"

- name: Setup Python
uses: actions/setup-python@v5
with:
python-version: '3.11'

- name: Checkout
uses: actions/checkout@v3
uses: actions/checkout@v5
with:
ref: ${{ github.head_ref }}

- name: Setup Python venv
run: |
Expand Down