[tool] chore(tooling): improve and sync renovate & gh actions #4730
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: "Generate a token" | ||
| id: generate-token | ||
| if: github.event.pull_request.head.repo.full_name == github.repository | ||
| uses: actions/create-github-app-token@v2 | ||
| with: | ||
| app-id: ${{ secrets.OPENAEV_PR_CHECKS_APP_ID }} | ||
| private-key: ${{ secrets.OPENAEV_PR_CHECKS_PRIVATE_KEY }} | ||
| - name: "Validate PR title and create check" | ||
| uses: FiligranHQ/filigran-ci-tools/actions/pr-title-check@v1 | ||
| with: | ||
| token: ${{ steps.generate-token.outputs.token }} |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 15 days ago
To fix the problem, explicitly define a least-privilege permissions block for this workflow or for the specific job. Since the job appears only to read repository data and use a GitHub App token, it should not need write access via GITHUB_TOKEN. A safe baseline is to set permissions: contents: read at the workflow level, which applies to all jobs.
The best fix with minimal functional impact is to add a permissions section at the top level of .github/workflows/oaev_shared_validate_pr_title.yml, between the on: block and jobs:. This will constrain the default GITHUB_TOKEN to read-only repository contents, which is typically sufficient for actions that just validate PR metadata and report via a separate app token. No new imports or external dependencies are needed; it is a pure YAML configuration change.
Concretely:
- In
.github/workflows/oaev_shared_validate_pr_title.yml, insert:
permissions:
contents: read- Place it after the
on:block (after line 5 in the snippet) and beforejobs:(line 6), keeping indentation consistent (no extra indentation for a top-level key).
| @@ -3,6 +3,8 @@ | ||
| pull_request: | ||
| branches: [master, release/current] | ||
| types: [opened, edited, reopened, ready_for_review, synchronize] | ||
| permissions: | ||
| contents: read | ||
| jobs: | ||
| validate-pr-title: | ||
| runs-on: ubuntu-latest |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #4730 +/- ##
=========================================
Coverage 55.18% 55.18%
Complexity 4301 4301
=========================================
Files 972 972
Lines 28899 28899
Branches 2119 2119
=========================================
Hits 15949 15949
Misses 12011 12011
Partials 939 939 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
guillaumejparis
force-pushed
the
improve-tooling
branch
from
687829a to
e69f5e3
Compare
Proposed changes
Testing Instructions
Related issues
Checklist
Further comments
If this is a relatively large or complex change, kick off the discussion by explaining why you chose the solution you did and what alternatives you considered, etc...