Skip to content

ci: restrict GITHUB_TOKEN permissions in workflows - #114

Merged
udondan merged 2 commits into
mainfrom
repo-health/workflow-permissions
Oct 30, 2026
Merged

udondan merged 2 commits into
mainfrom
repo-health/workflow-permissions

Conversation

@udondan

@udondan udondan commented Oct 30, 2026

Copy link
Copy Markdown
Owner

Sets explicit, minimal permissions on the jobs flagged by code scanning (actions/missing-workflow-permissions):

  • mr-test.yml → lint (reusable workflow call): contents: read
  • mr-test.yml → required: permissions: {} (only evaluates results of other jobs)
  • automerge-schedule.yml → automerge: permissions: {} (uses OVERRIDE_TOKEN, not GITHUB_TOKEN)

Addresses code scanning alerts #1, #2, #4.

@codecov

codecov Bot commented Oct 30, 2026 •

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 81.73%. Comparing base (fba0eb2) to head (54b2763).

Additional details and impacted files
@@           Coverage Diff           @@
##             main     #114   +/-   ##
=======================================
  Coverage   81.73%   81.73%           
=======================================
  Files          15       15           
  Lines        2113     2113           
=======================================
  Hits         1727     1727           
  Misses        386      386           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@udondan
udondan enabled auto-merge (squash) October 30, 2026 23:20
@udondan
udondan merged commit 25e14a9 into main Oct 30, 2026
20 checks passed
@udondan
udondan deleted the repo-health/workflow-permissions branch October 30, 2026 23:22
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant