Backport workflow-hardening fix (excessive-permissions) to 3 release branches
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 85/100
Research direction
Apply the suggested change to .github/workflows/stale.yml on stable-cascade-dtype, release-tests, and stable-cascade-upcasting. Start by comparing each branch with the default-branch fix, then run zizmor and actionlint for each workflow. Done means the excessive-permissions finding is cleared without new findings on all three branches.
Written by the indexing model from the issue text.
Description
Summary
The default branch already hardened .github/workflows/stale.yml against the issue(s) below, but 3 release branches still carry it. This proposes the same, minimal, scanner-verified fix for each.
What's flagged (by zizmor)
excessive-permissions— workflow/job granted broaderpermissionsthan needed
Already resolved on the default branch in:
Affected release branches (3)
stable-cascade-dtype(still present as of HEAD327d8e5a)release-tests(still present as of HEAD7ef1df4a)stable-cascade-upcasting(still present as of HEAD1ca9acc2)
Suggested per-branch patches
Each diff below was checked locally with zizmor and actionlint: the flagged finding(s) are cleared on the affected construct and no new lint or security findings are introduced. (Whitespace is normalized; only security-relevant lines change.)
stable-cascade-dtype — excessive-permissions
File .github/workflows/stale.yml; suggested edits:
-
- jobs.$J.permissions.issues = 'write'
-
- jobs.$J.permissions.pull-requests = 'write'
--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -25,3 +25,6 @@
- name: Close stale issues
run: |
python utils/stale.py
+ permissions:
+ issues: write
+ pull-requests: write
release-tests — excessive-permissions
File .github/workflows/stale.yml; suggested edits:
-
- jobs.$J.permissions.issues = 'write'
-
- jobs.$J.permissions.pull-requests = 'write'
--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -25,3 +25,6 @@
- name: Close stale issues
run: |
python utils/stale.py
+ permissions:
+ issues: write
+ pull-requests: write
stable-cascade-upcasting — excessive-permissions
File .github/workflows/stale.yml; suggested edits:
-
- jobs.$J.permissions.issues = 'write'
-
- jobs.$J.permissions.pull-requests = 'write'
--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -25,3 +25,6 @@
- name: Close stale issues
run: |
python utils/stale.py
+ permissions:
+ issues: write
+ pull-requests: write
Happy to open pull requests instead if that's preferred.
- Dominant language
- Python
- Stars
- 34.6k
- Forks
- 7.3k
- Avg merge
- 3d 16h
- Merged PRs (30d)
- 74
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from huggingface/diffusers
-
bug needs-env-info pipelines
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
huggingface/diffusers#14794 ·
-
bug needs-code-example needs-env-info pipelines
Difficulty 1/5 Under an hour Newbie friendliness 86/100
huggingface/diffusers#14780 · 1 comment ·
-
bug pipelines
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
huggingface/diffusers#14769 · 1 comment ·
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
huggingface/diffusers#14639 ·
-
Difficulty 1/5 Under an hour Newbie friendliness 88/100
huggingface/diffusers#14616 ·
All issues in huggingface/diffusers
Similar issues
-
documentation help wanted
Difficulty 2/5 1-3 hours Newbie friendliness 90/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 90/100
simonw/sqlite-utils#872 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100