Skip to content

Update 8hobbies/workflows digest to 23566a1 #273

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
renovate merged 1 commit into from
Nov 9, 2025
Merged

Update 8hobbies/workflows digest to 23566a1 #273

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/lint.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,4 +22,4 @@

jobs:
lint:
uses: 8hobbies/workflows/.github/workflows/npm-lint.yml@44f843881a46dc28b2d66c154b1231649b43498a
uses: 8hobbies/workflows/.github/workflows/npm-lint.yml@23566a16aca822bf91e20bf57b5715869e181339

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {}

Copilot Autofix

AI 2 months ago

To fix this problem, explicitly add a permissions: block at the root level of the workflow file (.github/workflows/lint.yml). This will ensure that any jobs in the workflow (including those using reusable workflows) have clearly limited permissions for the GITHUB_TOKEN according to least privilege. The best starting point is to use the minimal contents: read permission, which allows jobs to read repository contents without being able to perform any write operations, since the workflow's purpose is linting and should not require write permissions. Place the permissions: section after the workflow name: and before any triggers or jobs.

Suggested changeset 1
.github/workflows/lint.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -13,6 +13,8 @@
 # limitations under the License.
 
 name: Lint
+permissions:
+  contents: read
 
 on:
   push:
EOF
@@ -13,6 +13,8 @@
# limitations under the License.

name: Lint
permissions:
contents: read

on:
push:
Copilot is powered by AI and may make mistakes. Always verify output.
2 changes: 1 addition & 1 deletion .github/workflows/pages.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,4 +25,4 @@ jobs:
permissions:
pages: write
id-token: write
uses: 8hobbies/workflows/.github/workflows/npm-doc-pages.yml@44f843881a46dc28b2d66c154b1231649b43498a
uses: 8hobbies/workflows/.github/workflows/npm-doc-pages.yml@23566a16aca822bf91e20bf57b5715869e181339
2 changes: 1 addition & 1 deletion .github/workflows/publish-dry-run.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,4 +22,4 @@

jobs:
run:
uses: 8hobbies/workflows/.github/workflows/npm-publish-dry-run.yml@44f843881a46dc28b2d66c154b1231649b43498a
uses: 8hobbies/workflows/.github/workflows/npm-publish-dry-run.yml@23566a16aca822bf91e20bf57b5715869e181339

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {}

Copilot Autofix

AI 2 months ago

To fix this issue, you should explicitly add a permissions: block at the workflow level (top-level, after name: and before on:) in .github/workflows/publish-dry-run.yml. This ensures that the workflow applies the principle of least privilege, preventing jobs from inheriting excessive repository-level permissions. As this workflow appears to only need to perform a dry-run for publishing (and does not require write access), the minimal recommended permissions are contents: read. Add the following block:

permissions:
  contents: read

This change should be applied directly after the workflow’s name: definition.

Suggested changeset 1
.github/workflows/publish-dry-run.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/publish-dry-run.yml b/.github/workflows/publish-dry-run.yml
--- a/.github/workflows/publish-dry-run.yml
+++ b/.github/workflows/publish-dry-run.yml
@@ -13,6 +13,8 @@
 # limitations under the License.
 
 name: Publish Dry Run
+permissions:
+  contents: read
 
 on:
   push:
EOF
@@ -13,6 +13,8 @@
# limitations under the License.

name: Publish Dry Run
permissions:
contents: read

on:
push:
Copilot is powered by AI and may make mistakes. Always verify output.
2 changes: 1 addition & 1 deletion .github/workflows/publish.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,6 @@
tags: ["v*"]
jobs:
build:
uses: 8hobbies/workflows/.github/workflows/npm-publish.yml@44f843881a46dc28b2d66c154b1231649b43498a
uses: 8hobbies/workflows/.github/workflows/npm-publish.yml@23566a16aca822bf91e20bf57b5715869e181339
secrets:
npm-auth-token: ${{ secrets.NPM_TOKEN }}

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {}
2 changes: 1 addition & 1 deletion .github/workflows/runtime.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,4 +22,4 @@

jobs:
test:
uses: 8hobbies/workflows/.github/workflows/npm-runtime.yml@44f843881a46dc28b2d66c154b1231649b43498a
uses: 8hobbies/workflows/.github/workflows/npm-runtime.yml@23566a16aca822bf91e20bf57b5715869e181339

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {}

Copilot Autofix

AI 2 months ago

To fix the problem, add a permissions: block that limits the privileges granted to the GITHUB_TOKEN. The safest default is contents: read, which is sufficient for many workflows and is the minimal permission recommended unless the workflow specifically needs additional privileges (e.g., to create PRs or modify issues).
How to fix:
Add the following block near the top level of the workflow, after the name: (so it applies to all jobs unless individually overridden):

permissions:
  contents: read

No changes are needed to the reusable workflow usage or elsewhere.
Lines to change:
Between lines 15 and 16, insert the above block.
What is needed:
No extra methods, imports, or definitions are needed — only a YAML permission block in the correct place.

Suggested changeset 1
.github/workflows/runtime.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/runtime.yml b/.github/workflows/runtime.yml
--- a/.github/workflows/runtime.yml
+++ b/.github/workflows/runtime.yml
@@ -13,6 +13,8 @@
 # limitations under the License.
 
 name: Runtime
+permissions:
+  contents: read
 
 on:
   push:
EOF
@@ -13,6 +13,8 @@
# limitations under the License.

name: Runtime
permissions:
contents: read

on:
push:
Copilot is powered by AI and may make mistakes. Always verify output.