chore: use a single deploy workflow template #618
Conversation
lionello
had a problem deploying
to
deploy-changed-samples
GitHub Actions
Failure
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Checkout code | ||
| uses: actions/checkout@v4 | ||
|
|
||
| - name: Set up Node.js | ||
| uses: actions/setup-node@v4 | ||
| with: | ||
| node-version: "20" | ||
|
|
||
| - name: Install dependencies | ||
| run: npm install | ||
| working-directory: scripts | ||
|
|
||
| - name: Run tests | ||
| run: npm test | ||
| working-directory: scripts | ||
|
|
||
| preview-workflows: |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium test
This autofix suggestion was applied.
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 17 minutes ago
In general, the fix is to explicitly set a minimal permissions block for the workflow or for individual jobs, so that the GITHUB_TOKEN has only the scopes required. Here, both jobs only need to read repository contents (for checkout and script execution) and to read basic PR metadata (already available with contents: read), with no visible need for write access. The best fix is to add a root‑level permissions block (applies to all jobs) directly under the name: or on: section with contents: read. If in your environment the template-manager.js ever needs to write to PRs or issues, you could later extend this explicitly (e.g., pull-requests: write), but that is not evident from the provided snippet.
Concretely, in .github/workflows/test-scripts.yml, add:
permissions:
contents: readnear the top of the file (e.g., after name: Test Scripts and before on:). No additional imports, methods, or dependencies are required since permissions is a native workflow configuration key.
| @@ -1,5 +1,8 @@ | ||
| name: Test Scripts | ||
|
|
||
| permissions: | ||
| contents: read | ||
|
|
||
| on: | ||
| pull_request: | ||
| paths: |
lionello
committed this autofix suggestion 17 minutes ago.
| if: github.event_name == 'pull_request' | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Checkout code | ||
| uses: actions/checkout@v4 | ||
| with: | ||
| fetch-depth: 2 | ||
|
|
||
| - name: Set up Node.js | ||
| uses: actions/setup-node@v4 | ||
| with: | ||
| node-version: "20" | ||
|
|
||
| - name: Install dependencies | ||
| run: npm install | ||
| working-directory: scripts | ||
|
|
||
| - name: Get changed samples | ||
| run: ./scripts/check-modified-samples.sh > modified.txt | ||
|
|
||
| - name: Preview workflows | ||
| uses: actions/github-script@v7 | ||
| env: | ||
| DRY_RUN: "true" | ||
| with: | ||
| script: | | ||
| const script = require('./scripts/template-manager.js') | ||
| await script({github, context, core}); |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium test
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI about 19 hours ago
In general, the problem is fixed by adding an explicit permissions block to the workflow or to individual jobs, granting only the minimal scopes necessary for the actions being run. For this workflow, both jobs only need to read repository contents (for actions/checkout and to read scripts), and actions/github-script only uses github and context without any explicit write calls in the provided snippet. Therefore, contents: read is sufficient for both jobs. Defining permissions at the workflow root will apply to all jobs that do not override it and is the simplest change.
The best minimal fix is to add a workflow-level permissions block just under the name: (before on:), setting contents: read. This documents that the workflow only needs read access and ensures the GITHUB_TOKEN cannot perform unintended write operations even if org defaults are broad. No imports or other definitions are needed, as this is pure YAML configuration.
Concretely, in .github/workflows/test-scripts.yml, between line 1 (name: Test Scripts) and line 3 (on:), insert:
permissions:
contents: readNo other changes are required.
| @@ -1,5 +1,8 @@ | ||
| name: Test Scripts | ||
|
|
||
| permissions: | ||
| contents: read | ||
|
|
||
| on: | ||
| pull_request: | ||
| paths: |
lionello
had a problem deploying
to
deploy-changed-samples
GitHub Actions
Failure
jordanstephens
had a problem deploying
to
deploy-changed-samples
GitHub Actions
Error
…in permissions [no ci] Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
This creates a single
deploy.yamlfor all samples, so we don't need to maintain 80 copies of the same file.