🌿 Fern Regeneration -- September 2, 2025 #44
Conversation
![fern-api[bot]](https://avatars.githubusercontent.com/in/244756?s=60&v=4){kind=small}
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| needs: [ compile, test ] | ||
| if: github.event_name == 'push' && contains(github.ref, 'refs/tags/') | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Checkout repo | ||
| uses: actions/checkout@v4 | ||
| - name: Set up node | ||
| uses: actions/setup-node@v3 | ||
| - name: Install dependencies | ||
| run: yarn install | ||
| - name: Build | ||
| run: yarn build | ||
|
|
||
| - name: Publish to npm | ||
| run: | | ||
| npm config set //registry.npmjs.org/:_authToken ${NPM_TOKEN} | ||
| if [[ ${GITHUB_REF} == *alpha* ]]; then | ||
| npm publish --access public --tag alpha | ||
| elif [[ ${GITHUB_REF} == *beta* ]]; then | ||
| npm publish --access public --tag beta | ||
| else | ||
| npm publish --access public | ||
| fi | ||
| env: | ||
| NPM_TOKEN: ${{ secrets.NPM_TOKEN }} |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 18 days ago
To fix this problem, add an explicit permissions: section to the workflow file at either the workflow root level (applies to all jobs by default) or to specific jobs. The safest minimal starting point is to set contents: read at the root, ensuring all jobs only receive read access unless overridden. If any job (e.g., publish) needs more extensive permissions (write to repository contents, pull requests, or packages), add a more specific permissions: block to that job only. In this case, since none of the jobs require write access to repository contents (NPM publish uses an NPM token, not GITHUB_TOKEN), it is safe to apply contents: read at the root. Place the following permissions block at the top of the workflow file, just under the workflow name: and before on:.
| @@ -1,4 +1,6 @@ | ||
| name: ci | ||
| permissions: | ||
| contents: read | ||
|
|
||
| on: [push] | ||
|
|
This PR regenerates code to match the latest API Definition.