Conversation
|
Important Review skippedDraft detected. Please check the settings in the CodeRabbit UI or the You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| name: token-kit-tests | ||
| if: github.event.pull_request.draft == false | ||
| runs-on: ubuntu-latest | ||
|
|
||
| steps: | ||
| - name: Checkout sources | ||
| uses: actions/checkout@v6 | ||
|
|
||
| - name: Setup Node.js | ||
| uses: actions/setup-node@v4 | ||
| with: | ||
| node-version: "22" | ||
|
|
||
| - name: Setup pnpm | ||
| uses: pnpm/action-setup@v4 | ||
| with: | ||
| version: 9 | ||
| run_install: false | ||
|
|
||
| - name: Install just | ||
| uses: extractions/setup-just@v2 | ||
|
|
||
| - name: Install dependencies | ||
| run: pnpm install --frozen-lockfile | ||
|
|
||
| - name: Build token-sdk | ||
| run: cd js/token-sdk && pnpm build | ||
|
|
||
| - name: Run token-sdk unit tests | ||
| run: just js test-token-sdk | ||
|
|
||
| - name: Run token-client unit tests | ||
| run: just js test-token-client | ||
|
|
||
| - name: Lint token-sdk | ||
| run: just js lint-token-kit |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI about 14 hours ago
In general, fix this by explicitly declaring a minimal permissions block either at the workflow root (applies to all jobs) or on the specific job. Since this workflow only checks out code and runs local build/test/lint commands, it only needs read access to repository contents. We can safely set permissions: contents: read for the job (or at the top level) without changing any existing behavior.
The single best fix here is to add a permissions block to the token-kit-tests job definition in .github/workflows/token-kit.yml, just under the job name (or runs-on) and before steps. Concretely, we will insert:
permissions:
contents: readThis does not require any imports or additional methods, and it keeps the change localized to the shown snippet. No other files or sections need modification.
| @@ -32,6 +32,8 @@ | ||
| name: token-kit-tests | ||
| if: github.event.pull_request.draft == false | ||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| contents: read | ||
|
|
||
| steps: | ||
| - name: Checkout sources |
2 participants
No description provided.