Repository navigation
Conversation
pr-ci.yml had no workflow-level permissions, so every job without its own block ran with the repository default GITHUB_TOKEN scope. The token is also passed to e2e tests as GH_ACCESS_TOKEN. - Add top-level permissions: contents: read. - Add job-level permissions to lint: pull-requests: read, because golangci-lint-action only-new-issues calls pulls.get on pull_request. - Existing changes and agent-skill blocks are unchanged.
✅ Deploy Preview for images-devsy-sh canceled.
|
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
📝 Walkthrough
Merge Risk: ⚪ Minimal · up to
|
| Check name | Status | Explanation |
|---|---|---|
| Description Check |  |
Check skipped - CodeRabbit’s high-level summary is enabled. |
| Title check | |
The title clearly identifies the main change: setting the default pr-ci token permission to contents: read. It is concise and directly related to the workflow update. |
| Docstring Coverage | |
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0… |
| Linked Issues check | |
Check skipped because no linked issues were found for this pull request. |
| Out of Scope Changes check | |
Check skipped because no linked issues were found for this pull request. |
✨ Finishing Touches
-
✨ Simplify code
-
- Commit to this branch
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Warning
Some tools did not complete. Review the errors below.
🔧 zizmor (1.30.1)
-
.github/workflows/pr-ci.yml
-
INFO zizmor: 🌈 zizmor v1.30.1
WARN audit:audit{input=Workflow(file://.github/workflows/pr-ci.yml)}: zizmor::audit::unsound_ternary: couldn't parse expression: matrix.provider-mode || ''parity''
fatal: no audit was performed
'template-injection' audit failed on file://.github/workflows/pr-ci.ymlCaused by:
0: error in 'template-injection' audit
1: failed to locate subfeature 'Subfeature { after: 143, fragment: Regex(Regex("matrix\.provider\-mode\s+\|\|\s+'parity'")) }' in feature ''"${RUNNER_TEMP}/devsy-ci-microsandbox" run --label "${{ matrix.label }}" --expected-count "${{ matrix.expected-spec-count }}" --provider-mode "${{ matrix.provider-mode || ''parity'' }}"''
-
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
✅ Deploy Preview for devsydev canceled.
|
|
Tick the box to add this pull request to the merge queue (same as
|
1 participant
Why
pr-ci.ymlhad no workflow-levelpermissions:. Every job without its own block ran with the repository defaultGITHUB_TOKENscope, which may be read-write. The token is also passed into e2e tests asGH_ACCESS_TOKEN(github.tokenin the integration jobs), so an over-scoped token is exposed to test code.This sets the default to
contents: readand adds only the scope the audit below proves a job needs.Part of the pr-ci.yml restructuring series (hardening).
Changes
permissions: contents: read.lintjob-levelpermissions: contents: readandpull-requests: read. golangci-lint-actiononly-new-issues: truecallspulls.getonpull_requestevents usinggithub-token, which defaults togithub.token.changes(contents: read,pull-requests: read) andagent-skill(contents: read) blocks are unchanged.Per-job audit
pull_request)contents: read,pull-requests: read(already set on job)tokeninput is unused)contents: readcontents: read(already set on job)only-new-issuescallspulls.getonpull_requestcontents: read,pull-requests: read(added)contents: readcontents: readcontents: readbuild --snapshot(no API calls), upload-artifactcontents: readcontents: readrun-id)contents: readGH_ACCESS_TOKENcontents: readgithub.tokencontents: readneedsevaluation onlycontents: readNo job needed write scopes. No job needed
pull-requestsother thanchangesandlint. Artifact and cache actions use the runtime token, notGITHUB_TOKENscopes.Verification
permissionsis{contents: read}. Jobs with a permissions block arechanges,agent-skill,lint.actionlintv1.7.7: only one finding, the pre-existingbackground: truekey on thejlumbroso/free-disk-spacestep inintegration-tests. It is present onorigin/mainand was not changed here, because this PR limits edits to permissions blocks. Recentmainruns of pr-ci are green.pr-ci.yml.CI
pr-ci run 38694439014 on head eeba5e7: conclusion success. All jobs passed, including Lint, Pre-commit, Unit Tests (ubuntu/macos), Build CLI (all three), Provider Update Tests (windows), every e2e test (the jobs that receive
GH_ACCESS_TOKEN), and CI Success. No permission errors. No reruns were needed.CodeRabbit
CLI review (
coderabbit review --agent --committedagainst merge base 7d04a47): completed, 0 findings, reviewed.github/workflows/pr-ci.yml. GitHub CodeRabbit check: pass ("Review skipped: draft pull request"). Unresolved review threads: 0.Summary by CodeRabbit