Add permission checks for dependabot toolset#17983
Conversation
|
@copilot update smoke-codex to query 1 dependabot issue and make sure it receives some answer (can be empty). |
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
- Add `security-events: read` permission to smoke-codex.md - Configure github toolsets with `[default, dependabot]` to enable Dependabot API access - Add test step 8: query up to 1 Dependabot alert (empty result is acceptable) - Recompile smoke-codex.lock.yml with updated permissions and toolsets Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Done in dbd7942. Updated
The compiled |
|
📰 BREAKING: Smoke Copilot is now investigating this pull request. Sources say the story is developing... |
|
🎬 THE END — Smoke Claude MISSION: ACCOMPLISHED! The hero saves the day! ✨ |
|
✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟 |
|
Commit pushed: |
|
Smoke test results for §22330477639
Overall:
|
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Two small inline notes: the dependabot toolset addition and corresponding security-events: read permission look correct. No blocking issues.
📰 BREAKING: Report filed by Smoke Copilot
| pull-requests: read | ||
| security-events: read | ||
| env: | ||
| DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} |
There was a problem hiding this comment.
Adding security-events: read permission looks correct for Dependabot toolset support. Make sure the corresponding smoke-copilot workflow gets the same permission if it also uses dependabot toolsets.
|
Overall status: FAIL
|
|
📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤 |
|
Commit pushed: |
|
Smoke Test Results — Run §22330477648
Overall: PARTIAL (Serena
|
There was a problem hiding this comment.
💥 Automated smoke test review - all systems nominal!
💥 [THE END] — Illustrated by Smoke Claude
Ensures the compiler automatically requests
security-events: readwhen thedependabottoolset is configured intools.github, and validates it end-to-end in the smoke-codex workflow.Changes Made
tools.go: AddedisDependabotToolsetEnabledhelper andinjectDependabotPermission— called fromapplyDefaultssosecurity-events: readis injected intodata.Permissionsbefore validation runs, respecting any explicitly set level.compiler_activation_jobs.go: UpdatedbuildMainJobto useisDependabotToolsetEnabledas a safety net for programmatic compilation paths that bypassapplyDefaults.permissions_validator_test.go: AddedTestCollectRequiredPermissionscases for thedependabottoolset andTestInjectDependabotPermissioncovering injection, no-op for existing levels, and non-dependabot configurations (7 cases total).smoke-codex.md: Addedsecurity-events: readpermission, configuredtools.githubwithtoolsets: [default, dependabot], and added a Dependabot test step that callslist_dependabot_alertsfor up to 1 alert (empty result is acceptable).smoke-codex.lock.yml: Recompiled to reflect the updated permissions and toolsets.Testing
TestInjectDependabotPermission— 7 cases covering all injection scenariossmoke-codex.mdcompiles cleanly; agent job containssecurity-events: read💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.
Add permission checks for dependabot toolset
Ensures the compiler automatically requests
security-events: readwhen thedependabottoolset is configured intools.github, and validates it end-to-end in the smoke-codex workflow.Changes Made
tools.go: AddedisDependabotToolsetEnabledhelper andinjectDependabotPermission— called fromapplyDefaultssosecurity-events: readis injected intodata.Permissionsbefore validation runs, respecting any explicitly set level.compiler_activation_jobs.go: UpdatedbuildMainJobto useisDependabotToolsetEnabledas a safety net for programmatic compilation paths that bypassapplyDefaults.permissions_validator_test.go: AddedTestCollectRequiredPermissionscases for thedependabottoolset andTestInjectDependabotPermissioncovering injection, no-op for existing levels, and non-dependabot configurations (7 cases total).smoke-codex.md: Addedsecurity-events: readpermission, configuredtools.githubwithtoolsets: [default, dependabot], and added a Dependabot test step that callslist_dependabot_alertsfor up to 1 alert (empty result is acceptable).smoke-codex.lock.yml: Recompiled to reflect the updated permissions and toolsets.Testing
TestInjectDependabotPermission— 7 cases covering all injection scenariossmoke-codex.mdcompiles cleanly; agent job containssecurity-events: read💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more [Copilot coding agent tips]((gh.io/redacted) in the docs.
Changeset
security-events: readand runs through the smoke-codex validation.Warning
The following domains were blocked by the firewall during workflow execution:
codeload.github.comgithub.com✨ PR Review Safe Output Test - Run 22330477648