ci: ask for the token scopes these two workflows rely on - #501
Conversation
Both take their write access from the organization default rather than declaring it, which is the only thing keeping that default at write for every other job in the organization that never needed it. Signed-off-by: Yordis Prieto <yordis.prieto@gmail.com>
PR SummaryLow Risk Overview Each workflow now sets Reviewed by Cursor Bugbot for commit 45d6b59. Bugbot is set up for automated code reviews on this repo. Configure here. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Advanced Run ID: 📒 Files selected for processing (2)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. WalkthroughThe two GitHub Actions workflows now clear default token permissions and grant explicit write permissions to the jobs that create or update pull requests. ChangesWorkflow Permission Hardening
Priority: ➖ Normal Estimated code review effort: 1 (Trivial) | ~5 minutes Change: Other Merge Risk: ⚪ Minimal · up to Both workflows retain the write access required for their repository updates while reducing unintended default token permissions, with no remaining merge-blocking risk identified. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. A rabbit checks the workflow gate Comment |
1 participant
These are the only two workflows in the repository that get their write access from the organization's default token permission instead of declaring it. Everything else here already states what it needs.
That default is set for the whole organization, so these two are what keeps every other job across it holding a token that can write to its repository whether it asked for one or not. Naming the scopes here is what lets that default drop to read.
cherry-pick-pr-for-labelruns onpull_request_target, which gives a fork's branch a token carrying the base repository's access. A job that says what it needs is worth more on that trigger than on any other.