Skip to content

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Jun 1, 2025

This PR contains the following updates:

Package Type Update Change
8hobbies/workflows action digest 77dcc39 -> 71e7c31

Configuration

📅 Schedule: Branch creation - "on Sunday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot enabled auto-merge (squash) June 1, 2025 03:57
@renovate renovate bot requested a review from xuhdev as a code owner June 1, 2025 03:57
jobs:
lint:
uses: 8hobbies/workflows/.github/workflows/npm-lint.yml@77dcc391951a62ee0f1f076d6ef1bd3e5385eb42
uses: 8hobbies/workflows/.github/workflows/npm-lint.yml@71e7c31d67cdf9e3f03cb62c72951f48215e4c82

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {}

Copilot Autofix

AI 7 months ago

To fix the issue, we need to add a permissions block to the workflow file .github/workflows/lint.yml. This block should specify the least privileges required for the workflow to function correctly. Since this is a linting workflow, it likely only needs contents: read permission to access the repository's files for linting purposes.

The permissions block should be added at the root level of the workflow, ensuring it applies to all jobs, including the reusable workflow.


Suggested changeset 1
.github/workflows/lint.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -16,2 +16,5 @@
 
+permissions:
+  contents: read
+
 on:
EOF
@@ -16,2 +16,5 @@

permissions:
contents: read

on:
Copilot is powered by AI and may make mistakes. Always verify output.
jobs:
run:
uses: 8hobbies/workflows/.github/workflows/npm-publish-dry-run.yml@77dcc391951a62ee0f1f076d6ef1bd3e5385eb42
uses: 8hobbies/workflows/.github/workflows/npm-publish-dry-run.yml@71e7c31d67cdf9e3f03cb62c72951f48215e4c82

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {}

Copilot Autofix

AI 7 months ago

To fix the issue, we need to add a permissions block to the workflow. This block should specify the least privileges required for the workflow to function correctly. Since the workflow uses a reusable workflow (npm-publish-dry-run.yml), we should consult its documentation or analyze its functionality to determine the required permissions. If no specific permissions are documented, a safe starting point is to set contents: read, which is sufficient for most basic CI workflows.

The permissions block should be added at the root level of the workflow, ensuring it applies to all jobs unless overridden.

Suggested changeset 1
.github/workflows/publish-dry-run.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/publish-dry-run.yml b/.github/workflows/publish-dry-run.yml
--- a/.github/workflows/publish-dry-run.yml
+++ b/.github/workflows/publish-dry-run.yml
@@ -16,2 +16,5 @@
 
+permissions:
+  contents: read
+
 on:
EOF
@@ -16,2 +16,5 @@

permissions:
contents: read

on:
Copilot is powered by AI and may make mistakes. Always verify output.
jobs:
test:
uses: 8hobbies/workflows/.github/workflows/npm-runtime.yml@77dcc391951a62ee0f1f076d6ef1bd3e5385eb42
uses: 8hobbies/workflows/.github/workflows/npm-runtime.yml@71e7c31d67cdf9e3f03cb62c72951f48215e4c82

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {}

Copilot Autofix

AI 7 months ago

To fix the issue, we will add a permissions block at the root level of the workflow. This block will define the minimal permissions required for the workflow to function securely. Since the specific permissions required by the reusable workflow (npm-runtime.yml) are not provided, we will start with the most restrictive permissions (contents: read) and adjust them if necessary based on the workflow's functionality.


Suggested changeset 1
.github/workflows/runtime.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/runtime.yml b/.github/workflows/runtime.yml
--- a/.github/workflows/runtime.yml
+++ b/.github/workflows/runtime.yml
@@ -16,2 +16,5 @@
 
+permissions:
+  contents: read
+
 on:
EOF
@@ -16,2 +16,5 @@

permissions:
contents: read

on:
Copilot is powered by AI and may make mistakes. Always verify output.
@renovate renovate bot merged commit 06e088a into master Jun 1, 2025
13 checks passed
@renovate renovate bot deleted the renovate/all-digest branch June 1, 2025 03:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant