chore: Adjust build process#1444
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| runs-on: ubuntu-latest | ||
|
|
||
| steps: | ||
| - name: Checkout repository | ||
| uses: actions/checkout@v4 | ||
| with: | ||
| token: ${{ secrets.DISPATCH_ACCESS_TOKEN }} | ||
|
|
||
| - name: Set up Git | ||
| run: | | ||
| git config --global user.name 'box-sdk-build' | ||
| git config --global user.email '[email protected]' | ||
|
|
||
| - name: Fetch all branches and tags | ||
| run: git fetch --prune --unshallow | ||
|
|
||
| - name: Auto update pull requests | ||
| run: | | ||
| PR_LIST=$(curl -s -H "Authorization: Bearer ${{ secrets.DISPATCH_ACCESS_TOKEN }}" "https://api.github.com/repos/$GITHUB_REPOSITORY/pulls?state=open" | jq -r '.[] | .head.ref') | ||
| for pr_branch in $PR_LIST; do | ||
| git checkout "$pr_branch" | ||
| if git merge origin/combined-sdk; then | ||
| git push | ||
| else | ||
| # Conflict occurred, resolve by keeping our changes | ||
| git checkout --ours . | ||
| git add . | ||
| git commit -m "Auto resolve conflict by keeping our changes" | ||
| git push | ||
| fi | ||
| done |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 7 months ago
To fix the issue, add a permissions block to the workflow (either at the root or at the job level). This block limits the GITHUB_TOKEN permissions during the run, following least privilege. Based on the workflow's actions, it needs to be able to "read" repository contents and "write" to pull requests (since it updates PR branches and could interact with them or post commits). This matches the recommended minimal permissions for automation updating pull requests. You should add:
permissions:
contents: read
pull-requests: writeimmediately after the workflow name: and before on:, which will apply to the whole workflow. No further code changes are needed, as this only modifies the workflow permissions.
| @@ -1,4 +1,7 @@ | ||
| name: Autoupdate PR | ||
| permissions: | ||
| contents: read | ||
| pull-requests: write | ||
| on: | ||
| push: | ||
| branches: |
lukaszsocha2
force-pushed
the
combined-sdk
branch
from
8e8edfa to
c7d50d5
Compare
lukaszsocha2
force-pushed
the
fix-build
branch
from
e0884ac to
1922bd2
Compare
lukaszsocha2
force-pushed
the
fix-build
branch
from
928f501 to
e7a7458
Compare
3 participants
No description provided.