Skip to content

Conversation

@augustas1
Copy link
Collaborator

@augustas1 augustas1 commented Jul 18, 2025

  • add test
  • add CI workflow (lint, format, build, test)
  • add npm badge to readme

Copy link

@orca-security-eu orca-security-eu bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Orca Security Scan Summary

Status Check Issues by priority
Passed Passed Secrets high 0   medium 0   low 0   info 0 View in Orca

@augustas1 augustas1 force-pushed the tests branch 2 times, most recently from 424ad41 to ef10e2f Compare July 18, 2025 11:23
@augustas1 augustas1 force-pushed the tests branch 2 times, most recently from 42b567c to bfb9b4f Compare July 18, 2025 12:54
Comment on lines +9 to +20
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
- uses: pnpm/action-setup@v4
with:
version: 10
- run: pnpm install
- run: pnpm lint
- run: pnpm format
- run: pnpm build
- run: pnpm test

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read}

Copilot Autofix

AI 4 months ago

To fix the error, set the permissions key to restrict the GITHUB_TOKEN to the minimum required privilege. In this case, all workflow steps are read-only operations (checkout, install, lint, format, build, test), so only contents: read is needed. This can be set at the workflow level (top-level, applying to all jobs) or at the job level (under jobs.test). The best and simplest fix is to add a top-level permissions: block with contents: read directly below the workflow name (or at the top, before on: if no name is present), ensuring all jobs inherit this restriction.

Changes needed:

  • Insert permissions:\n contents: read after line 1 (directly after or before on:; both are valid, but after on: is most conventional if no workflow name exists).
  • No other changes or imports are needed.

Suggested changeset 1
.github/workflows/main.yaml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/main.yaml b/.github/workflows/main.yaml
--- a/.github/workflows/main.yaml
+++ b/.github/workflows/main.yaml
@@ -4,6 +4,9 @@
       - main
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ubuntu-latest
EOF
@@ -4,6 +4,9 @@
- main
pull_request:

permissions:
contents: read

jobs:
test:
runs-on: ubuntu-latest
Copilot is powered by AI and may make mistakes. Always verify output.
@augustas1 augustas1 requested a review from a team July 18, 2025 13:19
@augustas1 augustas1 marked this pull request as ready for review July 18, 2025 13:19
Copy link
Contributor

@danmichaeljones danmichaeljones left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM! We should remember to add a ticket for some additional tests too (e.g., the streaming) 👍

@augustas1 augustas1 merged commit e5caeb9 into main Jul 22, 2025
5 checks passed
@augustas1 augustas1 deleted the tests branch July 22, 2025 13:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants