Skip to content

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Dec 28, 2025

This PR contains the following updates:

Package Type Update Change
8hobbies/workflows action digest 00e8456 -> abd9589

Configuration

📅 Schedule: Branch creation - "on Sunday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot requested a review from xuhdev as a code owner December 28, 2025 01:16
@renovate renovate bot enabled auto-merge (squash) December 28, 2025 01:16
jobs:
lint:
uses: 8hobbies/workflows/.github/workflows/npm-lint.yml@00e84568aa8441faba7d53d88666b78e19c677d7
uses: 8hobbies/workflows/.github/workflows/npm-lint.yml@abd958951e5f7fe9cdc2b25bf6686a4ba5b5c47e

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {}

Copilot Autofix

AI 9 days ago

In general, to fix this issue you add an explicit permissions: block either at the workflow root (applies to all jobs) or under the specific job. For a lint job that just checks code, contents: read is typically sufficient, and you can tighten further if you know it needs even less. This ensures the GITHUB_TOKEN cannot be used to perform unintended write operations.

For this specific workflow in .github/workflows/lint.yml, the simplest and least disruptive fix is to add a minimal permissions: block at the top workflow level, just below name: Lint (before on:). That will apply to the lint job since it has no overriding permissions. We will set permissions: contents: read, which is a safe default for read‑only operations like linting. No imports or additional methods are needed because this is a YAML configuration change only.

Suggested changeset 1
.github/workflows/lint.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -17,6 +17,9 @@
 
 name: Lint
 
+permissions:
+  contents: read
+
 on:
   push:
     branches: ["master"]
EOF
@@ -17,6 +17,9 @@

name: Lint

permissions:
contents: read

on:
push:
branches: ["master"]
Copilot is powered by AI and may make mistakes. Always verify output.
@renovate renovate bot merged commit cc06e17 into master Dec 28, 2025
8 checks passed
@renovate renovate bot deleted the renovate/all-digest branch December 28, 2025 01:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant