Skip to content

Update workflow that handles contributor comments to the latest version#13580

Merged
rtibbles merged 1 commit intodevelopfrom
update-contributor-comment-workflow
Jul 21, 2025
Merged

Update workflow that handles contributor comments to the latest version#13580
rtibbles merged 1 commit intodevelopfrom
update-contributor-comment-workflow

Conversation

@MisRob
Copy link
Copy Markdown
Member

@MisRob MisRob commented Jul 21, 2025

Summary

Companion to learningequality/.github#29 which was tested in test-actions successfully. Also renames the file to match exactly the new example calling script in .github repository.

@github-actions github-actions bot added SIZE: small DEV: dev-ops Continuous integration & deployment and removed SIZE: small labels Jul 21, 2025
github-advanced-security[bot]
github-advanced-security AI found potential problems Jul 21, 2025
View reviewed changes
Comment thread .github/workflows/call-contributor-issue-comment.yml
Comment on lines +9 to +14
uses: learningequality/.github/.github/workflows/contributor-issue-comment.yml@main
secrets:
LE_BOT_APP_ID: ${{ secrets.LE_BOT_APP_ID }}
LE_BOT_PRIVATE_KEY: ${{ secrets.LE_BOT_PRIVATE_KEY }}
SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
SLACK_COMMUNITY_NOTIFICATIONS_WEBHOOK_URL: ${{ secrets.SLACK_COMMUNITY_NOTIFICATIONS_WEBHOOK_URL }}

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {}

Copilot Autofix

AI 9 months ago

To fix the problem, we should add a permissions: block that grants only the minimum privileges required for this workflow. Since the workflow responds to issue comments and may need to write to issues or pull requests (depending on what the reusable workflow does), a minimal but generally safe starting point is:

permissions:
  contents: read
  issues: write

If you know for sure that only read access (or only certain write privileges) are required, further restrict as appropriate. This block should be added at the top level of the workflow file (after the name: and before on:), to apply to all jobs in the workflow. No further code or method changes are necessary.

Suggested changeset 1
.github/workflows/call-contributor-issue-comment.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/call-contributor-issue-comment.yml b/.github/workflows/call-contributor-issue-comment.yml
--- a/.github/workflows/call-contributor-issue-comment.yml
+++ b/.github/workflows/call-contributor-issue-comment.yml
@@ -1,3 +1,6 @@
+permissions:
+  contents: read
+  issues: write
 name: Handle contributor comment on GitHub issue
 
 on:
EOF
@@ -1,3 +1,6 @@
permissions:
contents: read
issues: write
name: Handle contributor comment on GitHub issue

on:
Copilot is powered by AI and may make mistakes. Always verify output.
@MisRob
Copy link
Copy Markdown
Member Author

MisRob commented Jul 21, 2025

@rtibbles All secrets are already available in this repo, so no set up needed.

@MisRob MisRob requested a review from rtibbles July 21, 2025 14:48
@MisRob MisRob added the TODO: needs review Waiting for review label Jul 21, 2025
@rtibbles rtibbles merged commit b31fbff into develop Jul 21, 2025
56 checks passed
@rtibbles rtibbles deleted the update-contributor-comment-workflow branch July 21, 2025 14:59
@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Jul 21, 2025

Build Artifacts

Asset type Download link
PEX file kolibri-0.19.0a0.dev0_git.28.gf2a1b220.pex
Windows Installer (EXE) kolibri-0.19.0a0.dev0+git.28.gf2a1b220-windows-setup-unsigned.exe
Debian Package kolibri_0.19.0a0.dev0+git.28.gf2a1b220-0ubuntu1_all.deb
Mac Installer (DMG) kolibri-0.19.0a0.dev0+git.28.gf2a1b220.dmg
Android Package (APK) kolibri-0.19.0a0.dev0+git.28.gf2a1b220-0.1.4-debug.apk
Raspberry Pi Image kolibri-pi-image-0.19.0a0.dev0+git.28.gf2a1b220.zip
TAR file kolibri-0.19.0a0.dev0+git.28.gf2a1b220.tar.gz
WHL file kolibri-0.19.0a0.dev0+git.28.gf2a1b220-py2.py3-none-any.whl

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@rtibbles rtibbles rtibbles approved these changes

Assignees

No one assigned

Labels

DEV: dev-ops Continuous integration & deployment TODO: needs review Waiting for review

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@MisRob @rtibbles @github-advanced-security