Skip to content

fix: move workflow permissions to top #7

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
shavonn merged 1 commit into from
Apr 1, 2026
Merged

fix: move workflow permissions to top #7

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 4 additions & 3 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,14 +3,15 @@ name: Release
on:
pull_request:
types: [ closed ]

Copy link

Copilot AI Apr 1, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This blank line contains trailing whitespace. Please remove the extra spaces to avoid churn in diffs and potential whitespace/linting failures.

Suggested change

Copilot uses AI. Check for mistakes.
permissions:
contents: write
pull-requests: write

jobs:
release:
Comment on lines +6 to 12
Copy link

Copilot AI Apr 1, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Moving permissions to the workflow level makes these write permissions the default for all jobs in this workflow. If additional jobs are added later, consider either keeping write permissions scoped to the release job or explicitly overriding permissions for other jobs to preserve least-privilege.

Suggested change
permissions:
contents: write
pull-requests: write
jobs:
release:
jobs:
release:
permissions:
contents: write
pull-requests: write

Copilot uses AI. Check for mistakes.
if: github.event.pull_request.merged == true
runs-on: ubuntu-latest
permissions:
contents: write
pull-requests: write
steps:
- uses: actions/checkout@v6
with:
Expand Down
7 changes: 4 additions & 3 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,14 +46,15 @@ name: Release
on:
pull_request:
types: [ closed ]

Copy link

Copilot AI Apr 1, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This blank line contains trailing whitespace. Please remove the extra spaces to avoid churn in diffs and potential whitespace/linting failures.

Suggested change

Copilot uses AI. Check for mistakes.
permissions:
contents: write
pull-requests: write

jobs:
release:
Comment on lines +49 to 55
Copy link

Copilot AI Apr 1, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The YAML example now sets permissions at the workflow level, but the later "## Permissions" section still says to set permissions under the job's permissions key. Please update that text to reflect that workflow-level permissions is also valid (or adjust the example back to job-level) so the README stays consistent.

Suggested change
permissions:
contents: write
pull-requests: write
jobs:
release:
jobs:
release:
permissions:
contents: write
pull-requests: write

Copilot uses AI. Check for mistakes.
if: github.event.pull_request.merged == true
runs-on: ubuntu-latest
permissions:
contents: write
pull-requests: write
steps:
- uses: actions/checkout@v6
with:
Expand Down
Loading