[wip] Fix IA docs preview build#872
Conversation
Bumps [braces](https://github.com/micromatch/braces) to 3.0.3 and updates ancestor dependency [gulp](https://github.com/gulpjs/gulp). These dependencies need to be updated together. Updates `braces` from 2.3.2 to 3.0.3 - [Changelog](https://github.com/micromatch/braces/blob/master/CHANGELOG.md) - [Commits](https://github.com/micromatch/braces/commits/3.0.3) Updates `gulp` from 4.0.2 to 5.0.0 - [Release notes](https://github.com/gulpjs/gulp/releases) - [Changelog](https://github.com/gulpjs/gulp/blob/master/CHANGELOG.md) - [Commits](gulpjs/gulp@v4.0.2...v5.0.0) --- updated-dependencies: - dependency-name: braces dependency-version: 3.0.3 dependency-type: indirect - dependency-name: gulp dependency-version: 5.0.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [serve-static](https://github.com/expressjs/serve-static) from 1.15.0 to 1.16.2. - [Release notes](https://github.com/expressjs/serve-static/releases) - [Changelog](https://github.com/expressjs/serve-static/blob/v1.16.2/HISTORY.md) - [Commits](expressjs/serve-static@v1.15.0...v1.16.2) --- updated-dependencies: - dependency-name: serve-static dependency-version: 1.16.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
#822) * DOC-13250: CAO changes. I've left cloud-native and CMOS in but they can't be navigated to * Changed title to Kubernetes Operator
snap packages by default don't have access to filesystem. Not sure how to configure snap to grant that access, so instead pipe via stdin...
Co-authored-by: TimLFletcher <tim.fletcher@couchbase.com>
I observed the current populate-icon-defs.js script being OOM killed, having used 7.5MB of memory. This version now: * Uses `rg` to do the grepping, which should be fast and highly memory efficient. * Loads only the required icons from npm Local testing shows it emits the same results, though slightly re-ordered.
with optimization (memory) for the component stats wordcount
remove JSDOM and instead use the documentsConverted event, before the HTML is added to its frame. Use the lightweight `striptags` module.
* collate-logs.js script * formatting * make more robust
(Not exactly an Antora coordinate, but formatted in that style for compactness)
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| if: github.event.requested_reviewer.login == 'tech-comm-team-couchbase' | ||
| uses: couchbaselabs/docs-runner/.github/workflows/vale-review.yml@main | ||
| with: | ||
| path: home/ | ||
| pull_request_number: ${{ github.event.number }} | ||
| base_sha: ${{ github.event.pull_request.base.sha }} | ||
| head_sha: ${{ github.event.pull_request.head.sha }} | ||
| repository: ${{ github.repository }} | ||
| secrets: inherit |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI about 2 months ago
In general, to fix this class of issue you explicitly define a permissions: block either at the workflow root or per job, restricting the GITHUB_TOKEN to the minimal scopes the job needs (often contents: read for read-only operations, and adding more granular write scopes only if necessary).
For this specific workflow, the best minimal, non-breaking change is to add a permissions: block under the vale job. Since the job delegates all work to the reusable workflow and there is no evidence here that it needs write access, we can safely restrict permissions to contents: read. If the reusable workflow requires more (for example to comment on PRs), it should ideally request those in its own permissions block; this job can still safely use a read-only token. Concretely, in .github/workflows/review-requested.yml you should insert:
permissions:
contents: readbetween the uses: line and the existing with: block of the vale job. This leaves the workflow behavior unchanged aside from reducing the GITHUB_TOKEN scope for that job.
| @@ -9,6 +9,8 @@ | ||
| vale: | ||
| if: github.event.requested_reviewer.login == 'tech-comm-team-couchbase' | ||
| uses: couchbaselabs/docs-runner/.github/workflows/vale-review.yml@main | ||
| permissions: | ||
| contents: read | ||
| with: | ||
| path: home/ | ||
| pull_request_number: ${{ github.event.number }} |
|
Closing - fixed by simpler methods :) |
11 participants
No description provided.