Skip to content

Conversation

@jacquelynsmale
Copy link
Contributor

No description provided.

@jacquelynsmale jacquelynsmale requested a review from a team as a code owner November 6, 2025 00:00
call-changelog-check-workflow:
# Docs: https://github.com/ASFHyP3/actions
uses: ASFHyP3/actions/.github/workflows/reusable-changelog-check.yml@v0.20.0
uses: ASFHyP3/actions/.github/workflows/reusable-changelog-check.yml@v0.21.0

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {}

Copilot Autofix

AI about 2 months ago

To fix this issue, an explicit permissions block should be added to the job definition that calls the reusable workflow. This block should grant only the minimum permissions required by the job/reusable workflow. Since we do not know precisely what permissions the reusable workflow needs, a safe minimal starting point based on best practice is contents: read (to allow reading repo content) and, if necessary, more restrictive/targeted permissions. The block should be added under the job definition (call-changelog-check-workflow) at line 15 or 16, preceding the uses: line. No other code changes, imports, or definitions are required.

Suggested changeset 1
.github/workflows/changelog.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/changelog.yml b/.github/workflows/changelog.yml
--- a/.github/workflows/changelog.yml
+++ b/.github/workflows/changelog.yml
@@ -14,4 +14,6 @@
 jobs:
   call-changelog-check-workflow:
     # Docs: https://github.com/ASFHyP3/actions
+    permissions:
+      contents: read
     uses: ASFHyP3/actions/.github/workflows/reusable-changelog-check.yml@v0.21.0
EOF
@@ -14,4 +14,6 @@
jobs:
call-changelog-check-workflow:
# Docs: https://github.com/ASFHyP3/actions
permissions:
contents: read
uses: ASFHyP3/actions/.github/workflows/reusable-changelog-check.yml@v0.21.0
Copilot is powered by AI and may make mistakes. Always verify output.
call-labeled-pr-check-workflow:
# Docs: https://github.com/ASFHyP3/actions
uses: ASFHyP3/actions/.github/workflows/reusable-labeled-pr-check.yml@v0.20.0
uses: ASFHyP3/actions/.github/workflows/reusable-labeled-pr-check.yml@v0.21.0

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {}

Copilot Autofix

AI about 2 months ago

To fix the problem, add a permissions block to the job or at the root of the workflow, specifying the minimal privileges required. Since this workflow calls a reusable PR-label-check workflow (likely performing read-only checks on PR labels or metadata), the minimal starting point is contents: read. If the called workflow requires more (for example, modifying labels), we may also need pull-requests: write. Within the context given, the block should be added under the job's definition (call-labeled-pr-check-workflow) as a sibling to uses: (recommended for jobs that use reusable workflows). No imports or additional code is needed; only YAML key/value pairs added at the correct place.


Suggested changeset 1
.github/workflows/labeled-pr.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/labeled-pr.yml b/.github/workflows/labeled-pr.yml
--- a/.github/workflows/labeled-pr.yml
+++ b/.github/workflows/labeled-pr.yml
@@ -13,4 +13,7 @@
 jobs:
   call-labeled-pr-check-workflow:
     # Docs: https://github.com/ASFHyP3/actions
+    permissions:
+      contents: read
+      pull-requests: write
     uses: ASFHyP3/actions/.github/workflows/reusable-labeled-pr-check.yml@v0.21.0
EOF
@@ -13,4 +13,7 @@
jobs:
call-labeled-pr-check-workflow:
# Docs: https://github.com/ASFHyP3/actions
permissions:
contents: read
pull-requests: write
uses: ASFHyP3/actions/.github/workflows/reusable-labeled-pr-check.yml@v0.21.0
Copilot is powered by AI and may make mistakes. Always verify output.
@github-actions
Copy link

github-actions bot commented Nov 6, 2025

Developer checklist

  • Indicated the level of changes to this package by affixing one of these labels:
    • major -- Major changes to the API that may break current workflows
    • minor -- Minor changes to the API that do not break current workflows
    • patch -- Patches and bugfixes for the current version that do not break current workflows
    • bumpless -- Changes to documentation, CI/CD pipelines, etc. that don't affect the software's version
  • (If applicable) Updated the dependencies and indicated any downstream changes that are required
  • Added/updated documentation for these changes
  • Added/updated tests for these changes
  • Verified changes in test deployment and summarized results, e.g. in PR description or comments on the related issue(s)

Reviewer checklist

  • Have all dependencies been updated?
  • Is the level of changes labeled appropriately?
  • Are all the changes described appropriately in CHANGELOG.md?
  • Has the documentation been adequately updated?
  • Are the tests adequate?
  • Have the changes been verified in the test deployment?

@asjohnston-asf asjohnston-asf changed the title Release v6.0.1 Release v0.6.1 Nov 6, 2025
@jacquelynsmale jacquelynsmale merged commit 29c0440 into main Nov 6, 2025
19 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants