Skip to content

chore(ci): drop pull-requests: write from the weekly image scan - #41

Merged
tehw0lf merged 1 commit into
mainfrom
chore/weekly-scan-drop-pr-write
Oct 3, 2026
Merged

chore(ci): drop pull-requests: write from the weekly image scan#41
tehw0lf merged 1 commit into
mainfrom
chore/weekly-scan-drop-pr-write

Conversation

@tehw0lf

@tehw0lf tehw0lf commented Oct 3, 2026 •
edited by coderabbitai Bot
Loading

Copy link
Copy Markdown
Owner

The reusable post-publish-verification.yml only requests contents: read, packages: read and security-events: write; pull-requests: write was granted but never used. Same cleanup as yaft-admin#45 (least privilege).

Patch bump to 1.0.12 (lockfile synced). Validated locally: npm run lint && npm run test && npm run build.

https://claude.ai/code/session_01XqbkpQq5pBwhNU7g93j3RP

Summary by CodeRabbit

  • Chores
    • Updated the Flowdive package version to 1.0.12.
    • This update does not include any documented changes to user-facing features or behavior. Other changes relate to internal workflow permissions and do not affect the product experience.

@tehw0lf
chore(ci): drop pull-requests: write from the weekly image scan
29f110b 
post-publish-verification only requests contents: read, packages: read and
security-events: write, so the extra grant was unused. Same fix as
yaft-admin#45. Patch bump to 1.0.12.

Claude-Session: https://claude.ai/code/session_01XqbkpQq5pBwhNU7g93j3RP
@coderabbitai

coderabbitai Bot commented Oct 3, 2026 •
edited
Loading

Copy link
Copy Markdown

Review in Change Stack →

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration
  • Configuration used: defaults
  • Review profile: CHILL
  • Plan: Essentials
  • Run ID: 88972d41-9b51-4efd-881f-37cf10d346ec
📥 Commits

Reviewing files that changed from the base of the PR and between ac8f99d and 29f110b.

⛔ Files ignored due to path filters (1)
  • package-lock.json is excluded by !**/package-lock.json
📒 Files selected for processing (2)
  • .github/workflows/scan-published-image.yml
  • package.json
💤 Files with no reviewable changes (1)
  • .github/workflows/scan-published-image.yml

Included review availability: This review used your included allowance. 0 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 2 reviews per hour.

📝 Walkthrough

Walkthrough

The external scan job no longer has the pull-requests: write permission. The flowdive package version changes from 1.0.11 to 1.0.12.

Changes

Workflow Permission

Layer / File(s) Summary
Remove workflow permission
.github/workflows/scan-published-image.yml		 The external scan job no longer requests pull-requests: write.

Package Version

Layer / File(s) Summary
Update package version
package.json		 The flowdive package version changes from 1.0.11 to 1.0.12.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to 29f11

The scheduled image scan retains the permissions its inspected workflow needs, and the package version is synchronized with the lockfile. No concrete merge risk remains.

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly identifies the main change: removing the pull-requests: write permission from the weekly image scan.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Commit to this branch
  • Create a new PR
  • Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Comment @coderabbitai help to get the list of available commands.

@github-advanced-security

github-advanced-security AI commented Oct 3, 2026

Copy link
Copy Markdown

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

  • The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
  • Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
  • You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

@tehw0lf
tehw0lf merged commit 0ca858c into main Oct 3, 2026
24 checks passed
@tehw0lf
tehw0lf deleted the chore/weekly-scan-drop-pr-write branch October 3, 2026 02:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@tehw0lf @github-advanced-security