Github action for new releases #169
Conversation
New version checklist
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| runs-on: ubuntu-latest | ||
| name: new-version-checklist | ||
| steps: | ||
| - name: Checkout | ||
| uses: actions/checkout@v3 | ||
| - name: 'Comment PR' | ||
| uses: actions/github-script@0.3.0 | ||
| if: github.event_name == 'pull_request' | ||
| with: | ||
| github-token: ${{ secrets.GITHUB_TOKEN }} | ||
| script: | | ||
| var msg = `# New version checklist | ||
|
|
||
| - [ ] Package version in DESCRIPTION has been updated | ||
| - [ ] Release notes have been drafted/published | ||
| - [ ] Cheatsheet content has been updated (if applicable) | ||
| - [ ] Cheatsheet version has been updated | ||
|
|
||
| ` | ||
| const { issue: { number: issue_number }, repo: { owner, repo } } = context; | ||
| github.issues.createComment({ issue_number, owner, repo, body: msg }); |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 1 day ago
To fix this, add an explicit permissions block that limits the GITHUB_TOKEN to only what this workflow actually needs. The only GitHub API operation performed is github.issues.createComment, which requires issues: write. The checkout step can run with contents: read. The best fix is to add a permissions block inside the new-version-checklist job so the scope is limited just to this job, without affecting other workflows.
Concretely, in .github/workflows/new-version-checklist.yml, under jobs: new-version-checklist: and at the same indentation level as runs-on, insert:
permissions:
contents: read
issues: writeNo additional imports or methods are required; this is purely a configuration change to the workflow file and preserves existing functionality while constraining token permissions.
| @@ -8,6 +8,9 @@ | ||
| jobs: | ||
| new-version-checklist: | ||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| contents: read | ||
| issues: write | ||
| name: new-version-checklist | ||
| steps: | ||
| - name: Checkout |
Code Metrics Report
Reported by octocov |
Identical to nmfs-ost/asar#407