Conversation
dduugg
added a commit
that referenced
this pull request
Aug 17, 2026
Resolves the four open `actions/missing-workflow-permissions` CodeQL alerts. Each scope is the least privilege the job actually needs: - build.yml (#5): workflow-level `contents: read`. The single `build` job only checks out, restores an `actions/cache` entry, and runs `npm ci` / `npm run build:prod` / `npm test`. Neither setup-node nor actions/cache needs a token scope beyond reading the repo. - publish.yml (#1): workflow-level `contents: read`. Despite the name, this tag-triggered job does not publish anything — it runs `vsce package` and hands the .vsix to `actions/upload-artifact`. Uploading an artifact needs no extra scope, there is no `vsce publish`, no `gh release create`, and no `npm publish`, so no write scope is warranted. The Marketplace release is done off the artifact, not by this token. - stale.yml (#2): job-level `issues: write` + `pull-requests: write`. The shared-config stale workflow runs `actions/stale`, which comments on and closes both stale issues and stale PRs. A caller's permissions are the ceiling for the reusable workflow, so both scopes must be granted here or the nightly cron silently stops closing things. - triage.yml (#4): job-level `issues: write`. The shared-config triage workflow only runs `gh issue edit --add-label triage`. Callers use job-level blocks immediately above `uses:`, matching the accepted precedent in rubyatscale/query_packwerk. codeql.yml already declares its permissions and is left untouched.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.