Repository navigation
Add Zizmor - #992
Add Zizmor#992
Conversation
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Codecov Report✅ All modified and coverable lines are covered by tests.
☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
- Scope GitHub App tokens in publish-changelog and publish-release to the permissions they need instead of blanket installation permissions. - Set least-privilege permissions (contents: read) on tests, downstream and publish-changelog workflows instead of relying on the default GITHUB_TOKEN.
| app-id: ${{ vars.APP_ID }} | ||
| private-key: ${{ secrets.APP_PRIVATE_KEY }} | ||
| permission-contents: write | ||
| permission-pull-requests: write |
There was a problem hiding this comment.
I've seen permission-pull-requests break exactly this job in ipykernel (fixed by https://github.com/ipython/ipykernel/pull/1571/changes), the difference is that this one has content: read, investigating
There was a problem hiding this comment.
The PR you link to also change from app-id to client-id, I'll investigate.
There was a problem hiding this comment.
this still needs permission-pull-requests: write as it should open a changelog PR, but I'll push an app-id to client-id update.
4 participants
Per-commit review, the second one is auto-fix-all with zizmor