support log dlc lineage

[everettli]

No description provided.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
5 out of 6 committers have signed the CLA.

✅ YuZ1225
✅ pitt-liang
✅ luoyy82
✅ yangmianmian
✅ everettli
❌ firgavin
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

In general, the fix is to explicitly declare a restrictive permissions: block for the workflow or each job, instead of relying on the potentially broad repository default. For a pure lint workflow that just checks out code and runs local tools, the minimal required permission is contents: read.

The best way to fix this without changing existing functionality is to add a top-level permissions: block after the on: section in .github/workflows/lint.yaml, setting contents: read. This will apply to both common-lint and doc-lint jobs, which do not need to write to the repository or otherwise modify GitHub resources. No changes to the individual jobs or steps are required, and no imports or external dependencies are involved because this is a YAML workflow definition.

Concretely: in .github/workflows/lint.yaml, insert:

permissions:
  contents: read

between the existing on: [push] and concurrency: keys.

In general, the fix is to explicitly define a permissions block either at the workflow root (so it applies to all jobs) or per job, granting only the minimal scopes required. For this workflow, the jobs only need to read repository contents to allow actions/checkout to function; they do not need to write to contents, issues, or pull requests.

The best minimal fix while preserving behavior is to add a root-level permissions block just under the workflow name (or above on:), setting contents: read. This will apply to both common-lint and doc-lint jobs, and they will continue to function exactly as before, but with the GITHUB_TOKEN restricted to read-only repository contents. No other scopes (like pull-requests or issues) are needed because the jobs do not interact with those APIs.

Concretely, edit .github/workflows/lint.yaml near the top: insert

permissions:
  contents: read

after name: Lint test (line 1) and before on: [push] (line 3). No imports or additional methods are required because this is YAML configuration only.

In general, to fix this problem you should explicitly declare the minimal required GITHUB_TOKEN permissions for the workflow or for each job. For a unit-test workflow that only checks out code and runs tests, contents: read is usually sufficient. Defining this at the top level makes it apply to all jobs unless overridden.

The best minimal fix here is to add a permissions: block at the root of the workflow, just under the on: trigger. This will constrain GITHUB_TOKEN for the unit-test job (and any future jobs) without changing any steps. We do not need additional imports or changes to steps; we only add YAML configuration.

Concretely, in .github/workflows/unit.yaml, insert:

permissions:
  contents: read

between the on: [push] line and the existing concurrency: block. No other files or regions need to be changed.