-
Notifications
You must be signed in to change notification settings - Fork 97
chore: update dependencies to the latest versions #2016
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -14,94 +14,92 @@ | |
| on: pull_request | ||
| jobs: | ||
| unit-tests: | ||
| runs-on: ubuntu-22.04 | ||
| runs-on: ubuntu-24.04 | ||
| steps: | ||
| - name: Checkout source code | ||
| uses: actions/checkout@v3 | ||
| uses: actions/checkout@v4 | ||
| - name: Set up Go 1.23.8 | ||
| uses: actions/setup-go@v3 | ||
| with: | ||
| go-version: 1.23.8 | ||
| - name: Run unit tests | ||
| run: make test | ||
| multiplatform-image-build: | ||
Check warningCode scanning / CodeQL Workflow does not contain permissions Medium
Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read}
|
||
| strategy: | ||
| fail-fast: false | ||
| matrix: | ||
| runners: ['ubuntu-22.04', 'ubuntu-22.04-arm'] | ||
| runners: ['ubuntu-24.04', 'ubuntu-24.04-arm'] | ||
| runs-on: ${{matrix.runners}} | ||
| steps: | ||
| - name: Checkout source code | ||
| uses: actions/checkout@v3 | ||
| uses: actions/checkout@v4 | ||
| - name: Set arch environment variable | ||
| run: | | ||
| if [[ ${{matrix.runners}} == 'ubuntu-22.04' ]]; then | ||
| if [[ ${{matrix.runners}} == 'ubuntu-24.04' ]]; then | ||
| echo arch="amd64" >> $GITHUB_ENV | ||
| else | ||
| echo arch="arm64" >> $GITHUB_ENV | ||
| fi | ||
| - name: Build image | ||
| run: docker buildx build --platform linux/${{env.arch}} . | ||
| source-code-validation: | ||
| runs-on: ubuntu-22.04 | ||
| runs-on: ubuntu-24.04 | ||
| steps: | ||
| - name: Checkout source code | ||
| uses: actions/checkout@v3 | ||
| uses: actions/checkout@v4 | ||
| - name: Set up Go 1.23.8 | ||
| uses: actions/setup-go@v3 | ||
| with: | ||
| go-version: 1.23.8 | ||
| - name: Cache go modules | ||
| id: cache-mod | ||
| uses: actions/cache@v3 | ||
| with: | ||
| path: ~/go/pkg/mod | ||
| key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }} | ||
| restore-keys: | | ||
| ${{ runner.os }}-go- | ||
| - name: Download dependencies | ||
| run: go mod download | ||
| if: steps.cache-mod.outputs.cache-hit != 'true' | ||
| - name: Check go mod status | ||
| run: | | ||
| go mod tidy | ||
| if [[ ! -z $(git status -s) ]] | ||
| then | ||
| echo "Go mod state is not clean:" | ||
| git --no-pager diff | ||
| exit 1 | ||
| fi | ||
| - name: Check format | ||
| run: | | ||
| go install golang.org/x/tools/cmd/goimports@latest | ||
| go install github.com/che-incubator/check-license-header@379ba18fdb906d341ae451ea155cc34f1c4b4f1a | ||
| git reset HEAD --hard | ||
| echo "[INFO] Check code format and imports." | ||
| make fmt | ||
| if [[ ! -z $(git status -s) ]] | ||
| then | ||
| echo "not well formatted sources are found." | ||
| echo "execute 'make fmt' to fix the following:" | ||
| git --no-pager diff | ||
| exit 1 | ||
| fi | ||
|
|
||
| echo "[INFO] Check license headers." | ||
| FILES_TO_CHECK_LICENSE=$(find . \ | ||
| -not -path "./mocks/*" \ | ||
| -not -path "./vendor/*" \ | ||
| -not -path "./testbin/*" \ | ||
| -not -path "./bundle/stable/*" \ | ||
| -not -path "./config/manager/controller_manager_config.yaml" \ | ||
| \( -name '*.sh' -o -name "*.go" -o -name "*.yaml" -o -name "*.yml" \)) | ||
| LICENSE_TEMPLATE="${GITHUB_WORKSPACE}/hack/license-header.txt" | ||
| check-license-header -f "${LICENSE_TEMPLATE}" ${FILES_TO_CHECK_LICENSE} | ||
| dependencies-md-validation: | ||
| runs-on: ubuntu-22.04 | ||
| dependencies-validation: | ||
| runs-on: ubuntu-24.04 | ||
| steps: | ||
| - name: Checkout source code | ||
| uses: actions/checkout@v3 | ||
| - name: Validate DEPENDENCIES.md file | ||
| uses: che-incubator/[email protected] | ||
| env: | ||
| EXCLUDE_DEPS: "github.com/bmizerany/assert, gotest.tools/v3, github.com/dhui/dktest, gotest.tools, github.com/golangplus/testing" | ||
| - name: Checkout source code | ||
| uses: actions/checkout@v4 | ||
| - name: Check dependencies | ||
| run: build/scripts/clear-defined-test.sh | ||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -32,52 +32,52 @@ | |
|
|
||
| jobs: | ||
| build: | ||
| runs-on: ubuntu-22.04 | ||
| runs-on: ubuntu-24.04 | ||
| steps: | ||
| - uses: actions/checkout@v3 | ||
| - uses: actions/checkout@v4 | ||
| with: | ||
| fetch-depth: 0 | ||
| - name: Set up environment | ||
| run: | | ||
| sudo apt-get update -y || true | ||
| sudo apt-get -y -q install curl bash git | ||
| - name: Set up Python 3.9 | ||
| uses: actions/setup-python@v4 | ||
| with: | ||
| python-version: 3.9 | ||
| - name: Install yq | ||
| run: | | ||
| python -m pip install --upgrade pip | ||
| pip install yq | ||
| - name: Release che docs PRs | ||
| run: | | ||
| git config --global user.name "Mykhailo Kuznietsov" | ||
| git config --global user.email "[email protected]" | ||
| export GITHUB_TOKEN=${{ secrets.CHE_BOT_GITHUB_TOKEN }} | ||
| set -e | ||
| # if not run manually, need to compute che docs version from latest released CSV | ||
| if [[ "${{ github.event.inputs.version }}" == "" ]] || [[ "${{ github.event.inputs.version }}" == "7.y.z" ]]; then | ||
| chedocsVersion=$(grep Version version/version.go | cut -d \" -f2) | ||
| else | ||
| chedocsVersion="${{ github.event.inputs.version }}" | ||
| fi | ||
|
|
||
| # generic method to call a GH action and pass in a single var=val parameter | ||
| invokeAction() { | ||
| this_repo=$1 | ||
| this_action_name=$2 | ||
| this_workflow_id=$3 | ||
| this_var=$4 | ||
| this_val=$5 | ||
|
|
||
| # can compute using GH API | ||
| # workflow_id=$(curl -sSL https://api.github.com/repos/${this_repo}/actions/workflows -H "Authorization: token ${GITHUB_TOKEN}" -H "Accept: application/vnd.github.v3+json" | jq --arg search_field "${this_action_name}" '.workflows[] | select(.name == $search_field).id'); # echo "workflow_id = $workflow_id" | ||
| # or just pass it in | ||
| workflow_id=$this_workflow_id | ||
| set +e | ||
| curl -sSL https://api.github.com/repos/${this_repo}/actions/workflows/${workflow_id}/dispatches -X POST -H "Authorization: token ${GITHUB_TOKEN}" -H "Accept: application/vnd.github.v3+json" -d "{\"ref\":\"main\",\"inputs\": {\"${this_var}\":\"${this_val}\"} }" | ||
| echo "[INFO] Invoked '${this_action_name}' action ($workflow_id) - see https://github.com/${this_repo}/actions?query=workflow%3A%22${this_action_name// /+}%22" | ||
| } | ||
|
|
||
| # invoke action from che-docs repo | ||
| invokeAction eclipse/che-docs "Release Che Docs" "5193493" version "${chedocsVersion}" | ||
Check warningCode scanning / CodeQL Workflow does not contain permissions Medium
Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read}
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -32,63 +32,63 @@ | |
|
|
||
| jobs: | ||
| build: | ||
| runs-on: ubuntu-22.04 | ||
| runs-on: ubuntu-24.04 | ||
| steps: | ||
| - uses: actions/checkout@v3 | ||
| - uses: actions/checkout@v4 | ||
| with: | ||
| fetch-depth: 0 | ||
| - name: Set up environment | ||
| run: | | ||
| sudo apt-get update -y || true | ||
| sudo apt-get -y -q install curl bash git | ||
| - name: Set up Python 3.9 | ||
| uses: actions/setup-python@v4 | ||
| with: | ||
| python-version: 3.9 | ||
| - name: Install yq | ||
| run: | | ||
| python -m pip install --upgrade pip | ||
| pip install yq | ||
| - name: Release chectl PRs | ||
| run: | | ||
| git config --global user.name "Mykhailo Kuznietsov" | ||
| git config --global user.email "[email protected]" | ||
| export GITHUB_TOKEN=${{ secrets.CHE_INCUBATOR_BOT_GITHUB_TOKEN }} | ||
| set -e | ||
| # if not run manually, need to compute chectl version from latest released CSV | ||
| if [[ "${{ github.event.inputs.version }}" == "" ]] || [[ "${{ github.event.inputs.version }}" == "7.y.z" ]]; then | ||
| chectlVersion=$(grep Version version/version.go | cut -d \" -f2) | ||
| else | ||
| chectlVersion="${{ github.event.inputs.version }}" | ||
| fi | ||
|
|
||
| # generic method to call a GH action and pass in a single var=val parameter | ||
| invokeAction() { | ||
| this_repo=$1 | ||
| this_action_name=$2 | ||
| this_workflow_id=$3 | ||
| this_workflow_ref=$4 | ||
| this_params=$5 | ||
|
|
||
| # can compute using GH API | ||
| # workflow_id=$(curl -sSL https://api.github.com/repos/${this_repo}/actions/workflows -H "Authorization: token ${GITHUB_TOKEN}" -H "Accept: application/vnd.github.v3+json" | jq --arg search_field "${this_action_name}" '.workflows[] | select(.name == $search_field).id'); # echo "workflow_id = $workflow_id" | ||
| # or just pass it in | ||
| workflow_id=$this_workflow_id | ||
|
|
||
| inputsJson="{}" | ||
|
|
||
| IFS=',' read -ra paramMap <<< "${this_params}" | ||
| for keyvalue in "${paramMap[@]}" | ||
| do | ||
| key=${keyvalue%=*} | ||
| value=${keyvalue#*=} | ||
| echo $var1 | ||
| inputsJson=$(echo "${inputsJson}" | jq ". + {\"${key}\": \"${value}\"}") | ||
| done | ||
|
|
||
| curl -sSL https://api.github.com/repos/${this_repo}/actions/workflows/${workflow_id}/dispatches -X POST -H "Authorization: token ${GITHUB_TOKEN}" -H "Accept: application/vnd.github.v3+json" -d "{\"ref\":\"${this_workflow_ref}\",\"inputs\": ${inputsJson} }" | ||
| echo "[INFO] Invoked '${this_action_name}' action ($workflow_id) - see https://github.com/${this_repo}/actions?query=workflow%3A%22${this_action_name// /+}%22" | ||
| } | ||
|
|
||
| # invoke action from chectl repo | ||
| invokeAction che-incubator/chectl "Release - create pull request for upcoming release" "4008310" "main" "version=${chectlVersion}" | ||
Check warningCode scanning / CodeQL Workflow does not contain permissions Medium
Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read}
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -28,52 +28,49 @@ | |
|
|
||
| jobs: | ||
| build: | ||
| runs-on: ubuntu-22.04 | ||
| runs-on: ubuntu-24.04 | ||
| steps: | ||
| - uses: actions/checkout@v3 | ||
| - uses: actions/checkout@v4 | ||
| with: | ||
| fetch-depth: 0 | ||
| - name: Set up environment | ||
| run: | | ||
| sudo apt-get update -y || true | ||
| sudo apt-get -y -q install curl bash git | ||
| - name: Set up Python 3.9 | ||
| uses: actions/setup-python@v4 | ||
| with: | ||
| python-version: 3.9 | ||
| - name: Install operator courier, yq | ||
| run: | | ||
| python -m pip install --upgrade pip | ||
| pip install yq | ||
| - name: Release community operator PR | ||
| run: | | ||
| git config --global user.name "Mykhailo Kuznietsov" | ||
| git config --global user.email "[email protected]" | ||
| export GITHUB_TOKEN=${{ secrets.CHE_INCUBATOR_BOT_GITHUB_TOKEN }} | ||
| set -e | ||
| OP_SDK_DIR=/opt/operator-sdk | ||
| mkdir -p $OP_SDK_DIR | ||
| make download-operator-sdk DEST="${OP_SDK_DIR}" | ||
| export PATH="$PATH:$OP_SDK_DIR" | ||
| export QUAY_ECLIPSE_CHE_USERNAME=${{ secrets.QUAY_USERNAME }} | ||
| export QUAY_ECLIPSE_CHE_PASSWORD=${{ secrets.QUAY_PASSWORD }} | ||
|
|
||
| export QUAY_USERNAME_K8S=${{ secrets.QUAY_ECLIPSE_CHE_OPERATOR_KUBERNETES_USERNAME }} | ||
| export QUAY_PASSWORD_K8S=${{ secrets.QUAY_ECLIPSE_CHE_OPERATOR_KUBERNETES_PASSWORD }} | ||
| export QUAY_USERNAME_OS=${{ secrets.QUAY_ECLIPSE_CHE_OPERATOR_OPENSHIFT_USERNAME }} | ||
| export QUAY_PASSWORD_OS=${{ secrets.QUAY_ECLIPSE_CHE_OPERATOR_OPENSHIFT_PASSWORD }} | ||
| build/scripts/release/make-release.sh --prepare-community-operators-update ${{ github.event.inputs.forceflag }} | ||
| # - name: Create failure MM message | ||
| # if: ${{ failure() }} | ||
| # run: | | ||
| # echo "{\"text\":\":no_entry_sign: Che Community Operator ${{ github.event.inputs.version }} release has failed: https://github.com/eclipse-che/che-operator/actions/workflows/release-community-operator-PRs.yml\"}" > mattermost.json | ||
| # - name: Create success MM message | ||
| # run: | | ||
| # echo "{\"text\":\":white_check_mark: Che Community Operator ${{ github.event.inputs.version }} release PR has been created: https://github.com/redhat-openshift-ecosystem/community-operators-prod/pulls?q=is%3Apr+is%3Aopen+eclipse-che\"}" > mattermost.json | ||
| # - name: Send MM message | ||
| # if: ${{ success() }} || ${{ failure() }} | ||
| # uses: mattermost/[email protected] | ||
| # env: | ||
| # MATTERMOST_WEBHOOK_URL: ${{ secrets.MATTERMOST_WEBHOOK_URL }} | ||
| # MATTERMOST_CHANNEL: eclipse-che-releases | ||
| # MATTERMOST_USERNAME: che-bot | ||
Check warningCode scanning / CodeQL Workflow does not contain permissions Medium
Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read}
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -28,37 +28,37 @@ | |
|
|
||
| jobs: | ||
| release-helm-charts: | ||
| runs-on: ubuntu-22.04 | ||
| runs-on: ubuntu-24.04 | ||
| steps: | ||
| - uses: actions/checkout@v3 | ||
| - uses: actions/checkout@v4 | ||
| with: | ||
| fetch-depth: 0 | ||
|
|
||
| - name: Install Helm | ||
| uses: azure/setup-helm@v3 | ||
| with: | ||
| version: v3.4.0 | ||
|
|
||
| - name: Release | ||
| run: | | ||
| helm version | ||
| cp -rf "${GITHUB_WORKSPACE}"/helmcharts/stable /tmp/charts | ||
| git checkout gh-pages | ||
| mkdir -p charts/stable | ||
| mkdir -p charts/next | ||
| cp -rf /tmp/charts "${GITHUB_WORKSPACE}"/charts/new | ||
| helm package ./charts/new | ||
| mv *.tgz charts/stable/ | ||
| rm -rf ./charts/new | ||
|
|
||
| # Generate index.yaml with list Helm packages | ||
| helm repo index --url https://eclipse-che.github.io/che-operator/charts charts | ||
|
|
||
| git config --global user.name "Mykhailo Kuznietsov" | ||
| git config --global user.email "[email protected]" | ||
| export GITHUB_TOKEN=${{ secrets.CHE_BOT_GITHUB_TOKEN }} | ||
|
|
||
| git add . | ||
| git commit -am "Add new chart package." --signoff | ||
|
|
||
| git push origin gh-pages | ||
Check warningCode scanning / CodeQL Workflow does not contain permissions Medium
Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read}
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -29,116 +29,112 @@ | |
|
|
||
| jobs: | ||
| build: | ||
| runs-on: ubuntu-22.04 | ||
| runs-on: ubuntu-24.04 | ||
| steps: | ||
| - uses: actions/checkout@v3 | ||
| - uses: actions/checkout@v4 | ||
| with: | ||
| fetch-depth: 0 | ||
| - name: Check existing tags | ||
| run: | | ||
| set +e | ||
| RECREATE_TAGS=${{ github.event.inputs.forceRecreateTags }} | ||
| VERSION=${{ github.event.inputs.version }} | ||
| EXISTING_TAG=$(git ls-remote --exit-code origin refs/tags/${VERSION}) | ||
| if [[ -n ${EXISTING_TAG} ]]; then | ||
| if [[ ${RECREATE_TAGS} == "true" ]]; then | ||
| echo "[INFO] Removing tag for ${VERSION} version. New tag will be recreated during release." | ||
| git push origin :$VERSION | ||
| else | ||
| echo "[ERROR] Cannot proceed with release - tag ${EXISTING_TAG} already exists." | ||
| exit 1 | ||
| fi | ||
| else | ||
| echo "[INFO] No existing tags detected for $VERSION" | ||
| fi | ||
| - name: Set up QEMU | ||
| uses: docker/setup-qemu-action@v3 | ||
| - name: Set up Docker Buildx | ||
| uses: docker/setup-buildx-action@v3 | ||
| - name: Set up Python 3.9 | ||
| uses: actions/setup-python@v4 | ||
| with: | ||
| python-version: 3.9 | ||
| - name: Install operator courier, yq and base32 wrapper | ||
| run: | | ||
| python -m pip install --upgrade pip | ||
| pip install yq | ||
| pip install semver | ||
| sudo apt-get -y -q install | ||
| # get base32 util from che-release project | ||
| wget https://raw.githubusercontent.com/eclipse/che-release/master/utils/base32 | ||
| # copy base32 python-based helper script into dir that's accessed from PATH (so it's accessible to this and other called scripts) | ||
| sudo cp -f $(pwd)/base32 /usr/local/bin/ | ||
| sudo chmod +x /usr/local/bin/base32 | ||
| #remove base32 from current directory to avoid it being commited during release | ||
| rm $(pwd)/base32 | ||
| - name: Set up Go 1.23.8 | ||
| uses: actions/setup-go@v3 | ||
| with: | ||
| go-version: 1.23.8 | ||
| - name: Release operator | ||
| env: | ||
| IMAGE_REGISTRY_HOST: quay.io | ||
| IMAGE_REGISTRY_USER_NAME: eclipse | ||
| run: | | ||
| CHE_VERSION=${{ github.event.inputs.version }} | ||
| if [[ ${{ github.event.inputs.dryRun }} == "true" ]]; then DRY_RUN_FLAG="--dry-run"; fi | ||
| echo "CHE_VERSION=${CHE_VERSION}" | ||
| echo "DRY_RUN_FLAG=${DRY_RUN_FLAG}" | ||
| BRANCH=${CHE_VERSION%.*}.x | ||
| echo "BRANCH=${BRANCH}" | ||
| git config --global user.name "Mykhailo Kuznietsov" | ||
| git config --global user.email "[email protected]" | ||
| export GITHUB_TOKEN=${{ secrets.CHE_BOT_GITHUB_TOKEN }} | ||
| set -e | ||
|
|
||
| OP_SDK_DIR=/opt/operator-sdk | ||
| mkdir -p $OP_SDK_DIR | ||
| make download-operator-sdk DEST="${OP_SDK_DIR}" | ||
|
|
||
| go install golang.org/x/tools/cmd/goimports@latest | ||
|
|
||
| export PATH="$PATH:$OP_SDK_DIR" | ||
| export QUAY_ECLIPSE_CHE_USERNAME=${{ secrets.QUAY_USERNAME }} | ||
| export QUAY_ECLIPSE_CHE_PASSWORD=${{ secrets.QUAY_PASSWORD }} | ||
|
|
||
| if [[ ${CHE_VERSION} == *".0" ]]; then | ||
| build/scripts/release/make-release.sh ${CHE_VERSION} --release --check-resources --release-olm-files ${DRY_RUN_FLAG} | ||
| else | ||
| git checkout ${BRANCH} | ||
| build/scripts/release/make-release.sh ${CHE_VERSION} --release --release-olm-files ${DRY_RUN_FLAG} | ||
| fi | ||
|
|
||
| # default robot account on quay does not have permissions for application repos | ||
| # so we provide credentials for accounts that do | ||
| export QUAY_USERNAME_K8S=${{ secrets.QUAY_ECLIPSE_CHE_OPERATOR_KUBERNETES_USERNAME }} | ||
| export QUAY_PASSWORD_K8S=${{ secrets.QUAY_ECLIPSE_CHE_OPERATOR_KUBERNETES_PASSWORD }} | ||
| export QUAY_USERNAME_OS=${{ secrets.QUAY_ECLIPSE_CHE_OPERATOR_OPENSHIFT_USERNAME }} | ||
| export QUAY_PASSWORD_OS=${{ secrets.QUAY_ECLIPSE_CHE_OPERATOR_OPENSHIFT_PASSWORD }} | ||
| # echo "[DEBUG] Using credentials:" | ||
| # echo "[DEBUG] QUAY_USERNAME_K8S = ${QUAY_USERNAME_K8S} and" | ||
| # echo "[DEBUG] QUAY_USERNAME_OS = ${QUAY_USERNAME_OS}" | ||
|
|
||
| git checkout ${CHE_VERSION}-release | ||
| build/scripts/release/make-release.sh ${CHE_VERSION} --push-olm-bundles ${DRY_RUN_FLAG} | ||
|
|
||
| # perform extra checkouts to ensure branches exist locally | ||
| git checkout ${BRANCH} | ||
| git checkout ${CHE_VERSION}-release | ||
| force_update="" | ||
| if [[ ${{ github.event.inputs.forceRecreateTags }} == "true" ]]; then force_update="--force"; fi | ||
| build/scripts/release/make-release.sh ${CHE_VERSION} --push-git-changes --pull-requests ${force_update} ${DRY_RUN_FLAG} | ||
| #- name: Create failure MM message | ||
| #if: ${{ failure() }} | ||
| #run: | | ||
| #echo "{\"text\":\":no_entry_sign: Che Operator ${{ github.event.inputs.version }} release has failed: https://github.com/eclipse-che/che-operator/actions/workflows/release.yml\"}" > mattermost.json | ||
| #- name: Create success MM message | ||
| #run: | | ||
| #echo "{\"text\":\":white_check_mark: Che Operator ${{ github.event.inputs.version }} release PR have been created: https://github.com/eclipse-che/che-operator/pulls/che-bot\"}" > mattermost.json | ||
| #- name: Send MM message | ||
| #if: ${{ success() }} || ${{ failure() }} | ||
| #uses: mattermost/[email protected] | ||
| #env: | ||
| #MATTERMOST_WEBHOOK_URL: ${{ secrets.MATTERMOST_WEBHOOK_URL }} | ||
| #MATTERMOST_CHANNEL: eclipse-che-releases | ||
| #MATTERMOST_USERNAME: che-bot | ||
Check warningCode scanning / CodeQL Workflow does not contain permissions Medium
Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read}
|
||
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Copilot Autofix
AI 5 months ago
To fix the problem, add a
permissionsblock at the top level of the workflow file (.github/workflows/pr-check.yml), just below thename:and before theon:key. This will apply the specified permissions to all jobs in the workflow unless overridden at the job level. The minimal recommended permissions arecontents: read, which allows jobs to read repository contents but not write to them. If any job needs to write to pull requests (e.g., to post comments or statuses), you can addpull-requests: write, but based on the provided steps, onlycontents: readis required. No additional imports or definitions are needed.