Please define actions workflow permissions
还没有人认领这个 Issue。
评估
调研方向
首先阅读 .github/workflows/lighthouse.yml、.github/workflows/nodejs.yml 和 .github/workflows/publish.yml，然后盘点每个工作流的 jobs 和 uses entries。确定每个工作流所需的最小权限，在保持格式不变的情况下添加明确的最小权限块，并验证 YAML 语法和工作流要求仍然有效。
由索引模型根据 Issue 内容生成。
描述
Workflow permissions improvement
There are 3 workflow files that are currently lacking explicit permissions
Affected Workflow Files
The following workflow files need permissions to be explicitly defined:
Request
Ensure permissions are explicitly defined. Below are Copilot prompts/instructions if you would like Copilot's assistance with addressing this.
GitHub Copilot Assignment Prompts and Context
Task: Add explicit permissions to GitHub Actions workflow files that are currently missing them.
Scope: Update the workflow files listed above to include appropriate permissions: blocks.
Analysis Methodology:
- Gather Current State: Check if the workflow has any existing permissions defined
- Inventory Workflow Actions:
- Actions performed directly by the workflow
- API calls made by the workflow
- External actions included via
uses:statements
- Determine Required Permissions: Map each action to its minimum required permissions
- Synthesize Minimal Permissions: Create permissions block with only necessary permissions
Requirements:
- Add a
permissions:block to each workflow file that doesn't have one - Start with
contents: readas the minimum permission - Add additional permissions only if the workflow actually needs them based on the actions it performs
- Place the
permissions:block at the job level or workflow level as appropriate - Ensure the syntax is correct and follows YAML formatting
- Maintain existing content formatting, including indentation and comments
Files to modify: See the list of affected workflow files above.
Acceptance criteria:
- All listed workflow files have explicit permissions defined
- Permissions follow the principle of least privilege
- YAML syntax is valid
- Workflows still function correctly after changes
Copilot Instructions:
Please create a pull request that adds appropriate permissions: blocks to each of the workflow files listed above. Analyze each workflow to determine the minimum permissions required based on the actions it performs, and add only those necessary permissions.
- 主要语言
- TypeScript
- 星标
- 1.4k
- 派生
- 61
- 平均合并
- 1 天 15 小时
- 30 天内合并 PR
- 8
环境准备
在浏览器里用你自己的 GitHub 账号启动这个项目的开发容器。
- 没有 Dockerfile 或 Docker Compose 文件
- 没有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
github/catalyst 的其他 Issue
-
难度 2/5 1-3 小时 新手友好度 78/100
-
难度 5/5 一周以上 新手友好度 20/100
-
难度 5/5 一周以上 新手友好度 25/100
-
难度 3/5 1-2 天 新手友好度 42/100
-
难度 3/5 1-2 天 新手友好度 45/100
相似的 Issue
-
normalizePropName strips `#` characters from Figma property names instead of only the `#id` suffix未关闭
难度 2/5 1-3 小时 新手友好度 72/100
figma/code-connect#419 ·
-
bug
难度 2/5 1-3 小时 新手友好度 70/100
jeanibarz/knowledge-base-mcp-server#1268 ·
维护者通常 1 天内回复
-
难度 1/5 1 小时以内 新手友好度 78/100
Koenkk/zigbee-herdsman-converters#13820 ·
维护者通常 2 天内回复
-
A live recovery copy treats a large whole number and text with the same digits as the same value未关闭bug sharing & sync
难度 2/5 1-3 小时 新手友好度 64/100
维护者通常 1 天内回复
-
[prefer-expect-resolves] autofix leaves a stray ")" when the awaited expression is parenthesized未关闭
难度 2/5 1-3 小时 新手友好度 78/100
jest-community/eslint-plugin-jest#2052 ·