Update Workflows to Version 1.0.1 by epiverse-trace-bot · Pull Request #100 · epiverse-trace/git-rstudio-basics

epiverse-trace-bot · 2026-01-20T01:41:28Z

🤖 This is an automated build

Update Workflows from sandpaper version 0.16.12 -> 1.0.1

Auto-generated by create-pull-request on 2026-04-21T02:30+00:00

github-actions · 2026-01-20T01:41:39Z

ℹ️ Modified Workflows

This pull request contains modified workflow files and no preview will be created.

Workflow files modified:

.github/workflows/README.md
.github/workflows/docker_apply_cache.yaml
.github/workflows/docker_build_deploy.yaml
.github/workflows/docker_pr_receive.yaml
.github/workflows/pr-close-signal.yaml
.github/workflows/pr-comment.yaml
.github/workflows/pr-preflight.yaml
.github/workflows/sandpaper-version.txt
.github/workflows/update-cache.yaml
.github/workflows/update-workflows.yaml
.github/workflows/workflows-version.txt

If this is not from a trusted source, please inspect the changes for any malicious content.

+    name: "Preflight: PR or Manual Trigger?"
+    runs-on: ubuntu-latest
+    outputs:
+      do-apply: ${{ steps.check.outputs.merged_or_manual }}
+    steps:
+      - name: "Should we run cache application?"
+        id: check
+        run: |
+          if [[ "${{ github.event_name }}" == "workflow_dispatch" ||
+                ("${{ github.ref }}" == "refs/heads/main" && "${{ github.event.action }}" == "closed" && "${{ github.event.pull_request.merged }}" == "true") ]]; then
+            echo "merged_or_manual=true" >> $GITHUB_OUTPUT
+          else
+            echo "This was not a manual trigger and no PR was merged. No action taken."
+            echo "merged_or_manual=false" >> $GITHUB_OUTPUT
+          fi
+        shell: bash
+
+  check-renv:


Add an explicit top-level permissions block to the workflow so all jobs default to minimal token access, then keep/override job-level permissions where needed (already done for check-renv with id-token: write).

Best single fix in this file: insert at workflow root (after concurrency is a clean location) this block:

permissions:

contents: read

This preserves functionality for typical checkout/read operations while preventing implicit broad write access. check-renv can continue to request id-token: write at job level as it already does.

+    name: "No renv cache used"
+    runs-on: ubuntu-latest
+    needs: check-renv
+    if: needs.check-renv.outputs.renv-needed != 'true'
+    steps:
+      - name: "No renv cache needed"
+        run: echo "No renv cache needed for this lesson"
+
+  renv-cache-available:


Add an explicit workflow-level permissions block near the top of .github/workflows/docker_apply_cache.yaml so all jobs default to least privilege. Use contents: read as a safe baseline. Existing job-level overrides (like check-renv with id-token: write) remain valid and will continue to apply for that job. This avoids changing behavior while ensuring every job has explicit token scoping.

Best single change:

Edit .github/workflows/docker_apply_cache.yaml

Insert after description (before on:):
permissions: contents: read

No imports/dependencies/methods are needed.

+    name: "renv cache available"
+    runs-on: ubuntu-latest
+    needs: check-renv
+    if: needs.check-renv.outputs.renv-cache-available == 'true'
+    steps:
+      - name: "renv cache available"
+        run: echo "renv cache available for this lesson"
+
+  update-renv-cache:


Add an explicit top-level permissions: block in .github/workflows/docker_apply_cache.yaml so all jobs without their own permissions inherit restricted token rights.
Best minimal fix that preserves behavior: set workflow-level read-only defaults:

contents: read

packages: read

Keep existing job-level permissions blocks (like update-renv-cache) unchanged; job-level settings override workflow defaults where needed.

Edit region: immediately after the concurrency block and before jobs:.

No imports, methods, or dependencies are needed.

+    name: "Preflight: Schedule, Push, or PR?"
+    runs-on: ubuntu-latest
+    outputs:
+      do-build: ${{ steps.build-check.outputs.do-build }}
+      renv-needed: ${{ steps.build-check.outputs.renv-needed }}
+      renv-cache-hashsum: ${{ steps.build-check.outputs.renv-cache-hashsum }}
+      workbench-container-file-exists: ${{ steps.wb-vers.outputs.workbench-container-file-exists }}
+      wb-vers: ${{ steps.wb-vers.outputs.container-version }}
+      last-wb-vers: ${{ steps.wb-vers.outputs.last-container-version }}
+      workbench-update: ${{ steps.wb-vers.outputs.workbench-update }}
+    env:
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+    steps:
+      - name: "Should we run build and deploy?"
+        id: build-check
+        uses: carpentries/actions/build-preflight@main
+
+      - name: "Checkout Lesson"
+        if: steps.build-check.outputs.do-build == 'true'
+        uses: actions/checkout@v4
+
+      - name: "Get container version info"
+        id: wb-vers
+        if: steps.build-check.outputs.do-build == 'true'
+        uses: carpentries/actions/container-version@main
+        with:
+          WORKBENCH_TAG: ${{ vars.WORKBENCH_TAG }}
+          renv-needed: ${{ steps.build-check.outputs.renv-needed }}
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+  full-build:


Add an explicit permissions block to the preflight job in .github/workflows/docker_build_deploy.yaml, directly under runs-on (before outputs), granting only minimal required access.

Best single fix without changing functionality: set:

contents: read

This satisfies the CodeQL recommendation and supports actions/checkout plus typical read-only API usage in preflight checks. No imports/dependencies are needed.

@@ -33,48 +52,42 @@ jobs:
            echo "ok=false" >> $GITHUB_OUTPUT
            echo "Not Running Today"
          fi
+        shell: bash

-  check_renv:
-    name: "Check if We Need {renv}"
-    runs-on: ubuntu-22.04
+  check-renv:
+    name: "Check If We Need {renv}"
+    runs-on: ubuntu-latest
    needs: preflight
-    if: ${{ needs.preflight.outputs.ok == 'true'}}
+    if: ${{ needs.preflight.outputs.ok == 'true' }}


Add explicit least-privilege permissions blocks to jobs that currently lack them (preflight and check-renv).
Best minimal fix without changing behavior:

In .github/workflows/update-cache.yaml, under jobs.preflight, add:

permissions: {}
This denies token permissions for that job, which is appropriate since it only runs local shell logic.

Under jobs.check-renv, add:

permissions:

contents: read
This allows checkout (actions/checkout) while keeping access minimal.

No imports/dependencies/methods are needed (YAML config only).

+    name: "Record Caching Status"
+    runs-on: ubuntu-latest
+    needs: [check-renv, update-renv-cache]
+    if: always()
+    env:
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+    steps:
+      - name: "Record cache result"
+
+        run: |
+          echo "${{ needs.update-renv-cache.result == 'success' || needs.check-renv.outputs.renv-cache-available == 'true' || 'false' }}" > ${{ github.workspace }}/apply-cache-result
+        shell: bash
+
+      - name: "Upload cache result"
+        uses: actions/upload-artifact@v4
+        with:
+          name: apply-cache-result
+          path: ${{ github.workspace }}/apply-cache-result


Add an explicit permissions block at the workflow root in .github/workflows/docker_apply_cache.yaml, directly after concurrency and before jobs.
Use least privilege needed by the shown steps:

contents: read (safe baseline for checkout/read operations).

id-token: write (required for aws-actions/configure-aws-credentials@v6 OIDC federation).

actions: read (sufficient for normal workflow/action usage in this snippet).

This resolves the “workflow does not contain permissions” finding without changing workflow behavior.

epiverse-trace-bot added the type: template and tools label Jan 20, 2026

github-advanced-security AI found potential problems Jan 20, 2026

View reviewed changes

epiverse-trace-bot force-pushed the update/workflows branch from df82016 to 123a51d Compare January 27, 2026 01:47

epiverse-trace-bot changed the title ~~Update Workflows to Version 0.18.3~~ Update Workflows to Version 0.18.4 Jan 27, 2026

epiverse-trace-bot changed the title ~~Update Workflows to Version 0.18.4~~ Update Workflows to Version 0.18.5 Feb 3, 2026

epiverse-trace-bot force-pushed the update/workflows branch from 123a51d to 4dac433 Compare February 3, 2026 02:02

github-advanced-security AI found potential problems Feb 3, 2026

View reviewed changes

epiverse-trace-bot force-pushed the update/workflows branch from 4dac433 to b666d51 Compare February 10, 2026 02:23

epiverse-trace-bot force-pushed the update/workflows branch from b666d51 to 1fde194 Compare March 3, 2026 02:03

epiverse-trace-bot changed the title ~~Update Workflows to Version 0.18.5~~ Update Workflows to Version 1.0.0 Mar 3, 2026

[actions] update sandpaper workflow to version 1.0.1

339882b

epiverse-trace-bot force-pushed the update/workflows branch from 1fde194 to 339882b Compare April 21, 2026 02:30

epiverse-trace-bot changed the title ~~Update Workflows to Version 1.0.0~~ Update Workflows to Version 1.0.1 Apr 21, 2026

@@ -1,5 +1,7 @@
             name: "03 Maintain: Apply Package Cache"
             description: "Generate the package cache for the lesson after a pull request has been merged or via manual trigger, and cache in S3 or GitHub"
+            permissions:
+              contents: read
             on:
               workflow_dispatch:
                 inputs:

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update Workflows to Version 1.0.1#100

Update Workflows to Version 1.0.1#100
epiverse-trace-bot wants to merge 1 commit intomainfrom
update/workflows

epiverse-trace-bot commented Jan 20, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jan 20, 2026 •

edited

Loading

Uh oh!

Check warning

Copilot Autofix

Check warning

Copilot Autofix

Check warning

Copilot Autofix

Uh oh!

Check warning

Copilot Autofix

Check warning

Copilot Autofix

Check warning

Copilot Autofix

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

@@ -18,6 +18,9 @@
               group: docker-apply-cache
               cancel-in-progress: false
+            permissions:
+              contents: read
             jobs:
               preflight:
                 name: "Preflight: PR or Manual Trigger?"

Conversation

epiverse-trace-bot commented Jan 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jan 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

ℹ️ Modified Workflows

Uh oh!

Check warning

Copilot Autofix

Check warning

Copilot Autofix

Check warning

Copilot Autofix

Uh oh!

Check warning

Copilot Autofix

Check warning

Copilot Autofix

Check warning

Copilot Autofix

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

epiverse-trace-bot commented Jan 20, 2026 •

edited

Loading

github-actions Bot commented Jan 20, 2026 •

edited

Loading