-
Notifications
You must be signed in to change notification settings - Fork 2
Release v0.6.1 #72
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Release v0.6.1 #72
Conversation
Update to automatically publish to PyPI on release
| call-changelog-check-workflow: | ||
| # Docs: https://github.com/ASFHyP3/actions | ||
| uses: ASFHyP3/actions/.github/workflows/reusable-changelog-check.yml@v0.20.0 | ||
| uses: ASFHyP3/actions/.github/workflows/reusable-changelog-check.yml@v0.21.0 |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI about 2 months ago
To fix this issue, an explicit permissions block should be added to the job definition that calls the reusable workflow. This block should grant only the minimum permissions required by the job/reusable workflow. Since we do not know precisely what permissions the reusable workflow needs, a safe minimal starting point based on best practice is contents: read (to allow reading repo content) and, if necessary, more restrictive/targeted permissions. The block should be added under the job definition (call-changelog-check-workflow) at line 15 or 16, preceding the uses: line. No other code changes, imports, or definitions are required.
-
Copy modified lines R17-R18
| @@ -14,4 +14,6 @@ | ||
| jobs: | ||
| call-changelog-check-workflow: | ||
| # Docs: https://github.com/ASFHyP3/actions | ||
| permissions: | ||
| contents: read | ||
| uses: ASFHyP3/actions/.github/workflows/reusable-changelog-check.yml@v0.21.0 |
| call-labeled-pr-check-workflow: | ||
| # Docs: https://github.com/ASFHyP3/actions | ||
| uses: ASFHyP3/actions/.github/workflows/reusable-labeled-pr-check.yml@v0.20.0 | ||
| uses: ASFHyP3/actions/.github/workflows/reusable-labeled-pr-check.yml@v0.21.0 |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI about 2 months ago
To fix the problem, add a permissions block to the job or at the root of the workflow, specifying the minimal privileges required. Since this workflow calls a reusable PR-label-check workflow (likely performing read-only checks on PR labels or metadata), the minimal starting point is contents: read. If the called workflow requires more (for example, modifying labels), we may also need pull-requests: write. Within the context given, the block should be added under the job's definition (call-labeled-pr-check-workflow) as a sibling to uses: (recommended for jobs that use reusable workflows). No imports or additional code is needed; only YAML key/value pairs added at the correct place.
-
Copy modified lines R16-R18
| @@ -13,4 +13,7 @@ | ||
| jobs: | ||
| call-labeled-pr-check-workflow: | ||
| # Docs: https://github.com/ASFHyP3/actions | ||
| permissions: | ||
| contents: read | ||
| pull-requests: write | ||
| uses: ASFHyP3/actions/.github/workflows/reusable-labeled-pr-check.yml@v0.21.0 |
Developer checklist
Reviewer checklist
|
No description provided.