ci: Set required underlying permissions#931
Conversation
|
Note Other AI code review bot(s) detectedCodeRabbit has detected other AI code review bot(s) in this pull request and will avoid duplicating their findings in the review comments. This may lead to a less comprehensive review. 📝 WalkthroughSummary by CodeRabbit
WalkthroughAdded a top-level GitHub Actions permission Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Suggested reviewers
📜 Recent review detailsConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro 💡 Knowledge Base configuration:
You can enable these sources in your CodeRabbit configuration. 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (11)
✨ Finishing Touches🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. CodeRabbit Commands (Invoked using PR/Issue comments)Type Other keywords and placeholders
Status, Documentation and Community
|
There was a problem hiding this comment.
Pull Request Overview
This PR fixes missing permissions for scheduled workflow runs by adding required security-events write permissions to address privilege issues identified in GitHub Actions execution.
Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.
MaxymVlasov
changed the title
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
.github/workflows/scheduled-runs.yml (1)
13-13: Optional: future-proof for private repos.Per prior learnings, public repos only need
security-events: write; private repos also needactions: read(you already havecontents: read). Consider adding if this workflow will be used privately.
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
💡 Knowledge Base configuration:
- MCP integration is disabled by default for public repositories
- Jira integration is disabled by default for public repositories
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (1)
.github/workflows/scheduled-runs.yml(1 hunks)
🧰 Additional context used
🧠 Learnings (1)
📚 Learning: 2025-09-01T16:39:54.002Z
Learnt from: webknjaz
PR: antonbabenko/pre-commit-terraform#930
File: .github/workflows/ci-cd.yml:511-514
Timestamp: 2025-09-01T16:39:54.002Z
Learning: The zizmor-action (GitHub Actions security scanner) has different permission requirements based on repository visibility: for public repositories, only `security-events: write` is required; for private repositories, `contents: read` and `actions: read` are also needed alongside `security-events: write`.
Applied to files:
.github/workflows/scheduled-runs.yml
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (9)
- GitHub Check: 🧪 Tests / pytest@🐍3.11@windows-2025
- GitHub Check: 🧪 Tests / pytest@🐍3.10@windows-2025
- GitHub Check: 🧪 Tests / pytest@🐍3.9@windows-2025
- GitHub Check: 🧹 Linters / pre-commit@🐍3.13@ubuntu-latest
- GitHub Check: ∞ Main CI/CD pipeline / 🧪 Tests / pytest@🐍3.13@macos-13
- GitHub Check: ∞ Main CI/CD pipeline / 🧪 Tests / pytest@🐍3.9@macos-13
- GitHub Check: ∞ Main CI/CD pipeline / 🧪 Tests / pytest@🐍3.9@macos-14
- GitHub Check: ∞ Main CI/CD pipeline / 🧪 Tests / pytest@🐍3.12@macos-13
- GitHub Check: ∞ Main CI/CD pipeline / 🧪 Tests / pytest@🐍3.11@macos-13
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
.github/workflows/pre-commit.yaml (1)
46-53: Make the download more robust and verify checksumParsing JSON with grep is brittle; also we’re not verifying integrity. Suggest using jq to select the asset and validate SHA256.
- name: Install hadolint - run: >- - curl -L "$( - curl -s https://api.github.com/repos/hadolint/hadolint/releases/latest - | grep -o -E -m 1 "https://.+?/hadolint-linux-x86_64" - )" - > hadolint - && chmod +x hadolint && sudo mv hadolint /usr/bin/ + run: | + set -euo pipefail + API=https://api.github.com/repos/hadolint/hadolint/releases/latest + URL=$(curl -s "$API" | jq -r '.assets[] | select(.name=="hadolint-linux-x86_64") | .browser_download_url') + SHA=$(curl -s "$API" | jq -r '.assets[] | select(.name=="hadolint-linux-x86_64.sha256") | .browser_download_url' \ + | xargs -n1 curl -sL | awk '{print $1}') + curl -sSL "$URL" -o hadolint + echo "$SHA hadolint" | sha256sum -c - + chmod +x hadolint + sudo mv hadolint /usr/bin/
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
💡 Knowledge Base configuration:
- MCP integration is disabled by default for public repositories
- Jira integration is disabled by default for public repositories
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (1)
.github/workflows/pre-commit.yaml(1 hunks)
🧰 Additional context used
🧠 Learnings (1)
📓 Common learnings
Learnt from: webknjaz
PR: antonbabenko/pre-commit-terraform#930
File: .github/workflows/ci-cd.yml:511-514
Timestamp: 2025-09-01T16:39:54.002Z
Learning: The zizmor-action (GitHub Actions security scanner) has different permission requirements based on repository visibility: for public repositories, only `security-events: write` is required; for private repositories, `contents: read` and `actions: read` are also needed alongside `security-events: write`.
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (7)
- GitHub Check: ∞ Main CI/CD pipeline / 🧪 Tests / pytest@🐍3.13@macos-13
- GitHub Check: ∞ Main CI/CD pipeline / 🧪 Tests / pytest@🐍3.9@macos-14
- GitHub Check: ∞ Main CI/CD pipeline / 🧪 Tests / pytest@🐍3.12@macos-13
- GitHub Check: ∞ Main CI/CD pipeline / 🧪 Tests / pytest@🐍3.11@windows-2025
- GitHub Check: ∞ Main CI/CD pipeline / 🧪 Tests / pytest@🐍3.13@macos-14
- GitHub Check: ∞ Main CI/CD pipeline / 🧪 Tests / pytest@🐍3.10@macos-14
- GitHub Check: ∞ Main CI/CD pipeline / 🧹 Linters / pre-commit@🐍3.13@ubuntu-latest
🔇 Additional comments (1)
.github/workflows/pre-commit.yaml (1)
46-53: Correct asset name; fixes hadolint download on latest releasesSwitching to hadolint-linux-x86_64 matches current release asset names and unblocks the curl pipeline. (github.com)
|
This PR is included in version 1.100.1 🎉 |
Description of your changes
Fix missing privileges in scheduled runs - https://github.com/antonbabenko/pre-commit-terraform/actions/runs/17423654222