Release/v1.7.3.2

[ljy65535]

No description provided.

To fix this problem, we need to explicitly add a permissions: block specifying the least privilege required for the workflow jobs. Since both jobs only check out code and build Docker images, they do not require any special permissions—only the ability to read repository contents at most, so contents: read is enough. This block can be added at the workflow (top-level) right after the name: and before concurrency:, which will apply it to all jobs in the workflow. No other changes are required, and it will not affect any functionality of existing jobs.

---

To address this issue, we should explicitly set the minimum required permissions for the workflow. This can be done by adding a permissions block at the top level of the workflow YAML, before the jobs: key. The least privilege required for the steps shown (checking out code, cloning models, building Docker images) is read-only access to the repository contents. Therefore, set:

permissions:
  contents: read

No other permissions (write, etc.) are required here, so do not add them. Place the permissions: block after the name: and before concurrency: for clarity and conventional ordering.

---

To fix this issue, you should add a permissions block to restrict GITHUB_TOKEN permissions. The best way is to add it at the workflow root level (near the top, after name: and before concurrency: or on:), so it applies to all jobs by default. For this Docker build workflow, only minimal permissions are needed for checking out code and building images; contents: read is enough. No additional methods, imports, or definitions are required—simply add the permissions configuration.

To fix this problem, you should add an explicit permissions block to the workflow to restrict the default GITHUB_TOKEN permissions granted to all jobs. Since the jobs in this workflow only check out code and build Docker images—and do not modify repository contents, create issues, or interact with pull requests—you should set contents: read as the minimum required permission. This change can be made at the workflow level (top of the file, after name), which will apply to all jobs unless overridden. No changes to the jobs or steps are necessary.

---

To resolve the flagged issue, add a permissions block at the root level of the workflow YAML (ideally just below the workflow name and before concurrency). This block should restrict the GITHUB_TOKEN to only the necessary privilege. For this workflow, the minimal safe permission is to allow read-only access to repository contents (contents: read). No job in this workflow (based on the code provided) requires additional write permission.
Edit .github/workflows/auto-build-terminal-dev.yml by inserting the following block immediately after line 1:

permissions:
  contents: read

No additional imports or dependencies are required.

---

To fix the problem, you should add a permissions block at the workflow root level in the .github/workflows/auto-build-terminal-dev.yml file, immediately after the name: key and before any jobs or other blocks. Since all jobs shown only require code checkout and do local docker builds, the minimal permission required is contents: read. This ensures the GITHUB_TOKEN only has read access to repository contents for all jobs in this workflow, following the principle of least privilege. No other permissions appear necessary per the current workflow steps.

To fix this issue, we must add a permissions block at the workflow root (above the jobs: key), as no individual jobs have special permissions needs. This block should specifically set contents: read as the minimal starting point, which allows code checkout but blocks write access. If future workflow changes require more permissions (e.g., writing to issues or PRs), these can be added in a fine-grained manner. The change consists of inserting the following block into .github/workflows/auto-build-web-dev.yml, right after the workflow name (recommended) but, in any case, before the jobs: block.

To address this issue, you should add a permissions block to the workflow, ideally at the root level so it applies to all jobs unless overridden. According to least privilege principles for the given workflow, set contents: read. This is a sufficient minimal baseline for typical operations like checking out code. This change should be made at the top level of the file, after the name: and before concurrency: or on:, to ensure the permissions setting is inherited by both jobs. No additional code, methods, or imports are needed since this is a configuration change within the YAML file.

To fix the problem, the workflow YAML needs an explicit permissions: block that sets the minimum required privileges for the workflow to run. In this case, since the workflow only checks out code and interacts with Docker, and does not require write-access to repository contents or other resources, the safest default is contents: read. This should be added near the top of the workflow file, immediately after the workflow name and before the on: block (or at the job level if specific jobs need different permissions, but in this case a workflow-level permission suffices and is cleanest).

How to fix:

• Add the following block to the workflow file, directly beneath name: Docker Image Pull Test:

  permissions:
    contents: read

• This restricts the GITHUB_TOKEN used during the workflow to only be able to read repository contents.

No further changes, imports, or definitions are needed.

To fix the issue, we should avoid logging sensitive information such as API keys. The log message on line 295 (and line 269, which is similar and should also be addressed for completeness) currently includes the raw API key in its message. The best practice is to either remove the API key from the log entirely or, if necessary for debugging, log only a non-sensitive identifier (such as the last 4 characters, or its length—though even this should be avoided if possible).

Specifically, in backend/services/model_health_service.py:

• Edit the log message in the logger.warning call on line 295 (and line 269) to exclude the API key or replace it with a redacted version (e.g., ***REDACTED*** or ***).
• No new imports or method definitions are needed; just a change to the log message formatting.

---