D->M

[bio-boris]

• I incremented the version in the VERSION file
• I updated CHANGELOG.md
• I added test coverage for any changes

To fix this problem, we should add a permissions block to the workflow file, .github/workflows/manual-build.yml. Since the workflow's main activity is building and pushing, and it uses a reusable workflow, we should grant only the minimal permissions required for the workflow to operate. If we are uncertain what permissions are needed for the reusable workflow, a good minimal starting point (as recommended by CodeQL) is to set all permissions to read. You can define the permissions block at the top level, so it applies to all jobs, unless jobs set their own restrictions.
Changes needed:

• Add a permissions: block before the jobs: key in .github/workflows/manual-build.yml.
• The block should specify contents: read as the baseline least privilege.
  No additional methods, definitions, or imports are needed—the change is the addition of a simple YAML block.

To fix the issue, add a permissions block at the top level of the workflow (global to all jobs), specifying the minimal set of permissions required by the jobs. If most jobs only need to read repository contents, you can set contents: read; if you know a subset of jobs (such as those pushing code or tags) require additional permissions (contents: write or pull-requests: write), you should consider setting those on those jobs individually, or broaden at the root if all need them. Based on the file's described jobs (building, tagging, pushing, scanning), the minimal starting point can be contents: read globally, but review or testing may require adding contents: write, pull-requests: write, or similar on jobs that push code, images, or create tags. In this fix, introduce at the workflow root:

permissions:
  contents: read

You may wish to expand this as you confirm job-level requirements.

The change needed is:

• Insert a permissions: block after the workflow name (line 2).
  No new packages or imports are required; the fix is made only in .github/workflows/pr_build.yml.

To fix this problem, add an explicit permissions block to the workflow. This can be done at the root level (so all jobs inherit it), or individually per job if some jobs require more or fewer privileges. Since the jobs here primarily build, tag, push, and scan on pull requests, it's safest to set a minimal contents: read at the workflow level, and expand only if any jobs require more privilege (for example, if pushing to releases, writing commit statuses, or posting comments on pull requests). As a starting point, set:

permissions:
  contents: read

at the top after the name: field. This gives all jobs access only to read repository contents. If a job (such as one that needs to comment on a pull request) needs more, you would expand only that job's permissions.

Files/regions/lines to change:

• Edit .github/workflows/pr_build.yml
• Add the permissions: block just below the name: on line 2 (i.e., as line 3), pushing the rest of the content down by one.

What is needed:

• A single YAML block.
• No imports or other code changes are needed.

---

To fix this issue, add a permissions key at the top level of .github/workflows/pr_build.yml (just below the name: and before on:) to restrict the permissions of the GITHUB_TOKEN that runs this workflow. Since this workflow is triggered by pull requests and delegates actual work to reusable workflows, it's safest to start with the minimal recommended permissions: contents: read only. This allows the workflow to read repository contents, but not push, create, or modify anything. If this workflow (including the reusable workflows it calls) needs to create or modify pull requests (for example, update statuses or post comments), you could add pull-requests: write. Otherwise, stay as restrictive as possible.

Region to change:

• File: .github/workflows/pr_build.yml
• Add the following block near the top, below name: and before on:

No imports, definitions, or methods required; just add the YAML block.

To fix the problem, explicitly add a permissions block at the top level of the workflow so that all jobs launched in this workflow (unless they declare their own permissions) inherit these minimal privileges. The safest starting point is to grant only read access to repository contents with:

permissions:
  contents: read

This ensures any job in the workflow or in a downstream called reusable workflow will not receive write access to the repository from the GITHUB_TOKEN, unless they explicitly request more in their own scope.
The change should be made by adding the permissions block directly below the name key, and above the on key, at the top of the file.

---

To fix this problem, a permissions block should be added — ideally at the top-level of the workflow YAML file so it applies to all jobs, unless specific jobs require additional write permissions. The default should be as restrictive as possible, ideally contents: read, which is sufficient for most build/test workflows triggered by pull requests. If certain jobs require elevated permissions (such as pull-requests: write or contents: write to push changes), they can have a more permissive block on that job only. The fix is to insert a top-level permissions block after the name field, specifying the minimal required access; based on the current jobs, contents: read should be enough. If subsequent investigation shows write is needed for releases, tags, or pull requests, that can be expanded.

To fix the problem, introduce a permissions block at the workflow root (just after the name: line) in .github/workflows/release-main.yml. To observe the least-privilege principle, set contents: read, which is the minimal permission needed for most workflows, unless additional permissions are required by the jobs. Since all jobs here are simple uses calls to reusable workflows and there is no evidence they require higher privileges, starting with contents: read is appropriate. If any of the called reusable workflows need additional or write permissions, specify these as finely as possible.

Steps:

• Insert

  permissions:
    contents: read

  after the name: line (after line 2).

No other code or dependency changes are needed.

---

To fix the problem, add an explicit permissions key at the root of the workflow file, directly under the name: or on: fields. This should grant only the minimal required permissions for the workflow to function correctly. Since the workflow uses reusable workflows for validating a branch, validating a release tag, and building/pushing an image, it's likely that read access to the repository contents (contents: read) is sufficient for most steps. If any step requires additional permissions (such as packages: write for Docker or npm registry, or pull-requests: write), these should be explicitly added at the root or per-job basis as needed.

As a minimal starting point, and unless further knowledge about the needs of the downstream reusable workflows is provided, supplying contents: read as the default is the safest option. You can adjust and expand as necessary if errors arise due to permission issues.

You need to:

• Insert the following block after the name: field (preferably) in .github/workflows/release-main.yml:

  permissions:
    contents: read

To fix this issue, add a permissions block at the root of the workflow (just below name: and before on:), specifying the minimum required permissions for the workflow. Since this workflow only involves running checks and triggering builds/pushes (presumably via reusable workflows), it's most secure to start with contents: read. If any job or called workflow needs greater or more specific permissions (pull-requests: write, etc.), those should be explicitly set at the job or reusable workflow level. The change should be a single, simple edit near the top of the workflow file.

• How:
  Add

  permissions:
    contents: read

  immediately after the name: line, and before the on: block.

• What:
  Only edit .github/workflows/release-main.yml. No function/method changes are required; this is a metadata-only change in the workflow YAML file.

• Where:
  After line 2, before line 3.

---

The recommended fix is to add a minimal permissions block specifying the least privilege necessary for the job to function. Since the workflow as shown does not require write access to the repository's contents and only performs read operations (checking out code, running tests, uploading coverage), the safest default is to set contents: read. Add a permissions: section at the top level of the workflow, immediately below the name: field, or at the job level (inside the test: job block); for workflows with simple or single jobs, top-level is preferred and more DRY. This requires editing the .github/workflows/test.yml file, inserting:

permissions:
  contents: read

immediately before the on: declaration.

No changes to imports, definitions, or other configuration are required.

---

[Copilot]

Pull Request Overview

This PR migrates the project from Docker Compose v1 to v2 commands, updates Python dependencies, and adds new configuration options for skipping specific workspaces and controlling narrative reindexing behavior.

Reviewed Changes

Copilot reviewed 28 out of 29 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
tests/wait_for_deps.py	Updated docker-compose command to docker compose
tests/unit/test_config.py	Added new test file for configuration validation
tests/unit/index_runner/test_main.py	Added tests for workspace skipping and reindex limits
tests/unit/index_runner/releng/test_samples.py	Fixed edge property names from "from"/"to" to "_from"/"_to"
src/utils/kafka.py	Added poll timeout configuration and optimized config calls
src/utils/config.py	Added new configuration options for workspace skipping and narrative reindexing
src/index_runner/releng/samples.py	Updated edge properties and removed extra whitespace
src/index_runner/releng/import_obj.py	Added debug logging for releng indexer
src/index_runner/main.py	Added workspace skipping logic and ES skip configuration
src/index_runner/es_indexer.py	Fixed alias creation with proper prefix
spec/re_config.yaml	Added minimal RE-only configuration file
scripts/*	Updated Docker Compose commands and enhanced test coverage
pyproject.toml	Updated Python version and dependencies
docker-compose.yaml	Removed version specification and added platform comments
VERSION	Incremented version to 1.9.21
README.md	Enhanced documentation with dependencies and configuration
Dockerfile	Updated Python version and build dependencies
CHANGELOG.md	Added release notes for recent versions
.github/workflows/*	Added comprehensive CI/CD workflows
.github/dependabot.yml	Added dependency management configuration
.github/codeql.yml	Added security scanning workflow
.coveragerc	Added test coverage configuration

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[Copilot]

Missing space in YAML syntax - should be 'workflow_dispatch:' with proper indentation.

Suggested change

	workflow_dispatch:
	workflow_dispatch: