Skip to content

fix: set canary release on demand #128

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 4 commits into from
Oct 8, 2025
Merged

fix: set canary release on demand #128

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
90a0539
fix: make canary release to be on demand
juangm Oct 8, 2025
5817e40
Merge branch 'main' into fix/remove-canary
juangm Oct 8, 2025
ce86d1d
fix
juangm Oct 8, 2025
99976b5
fix
juangm Oct 8, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
42 changes: 0 additions & 42 deletions .github/workflows/cd.yml
View file
Open in desktop

This file was deleted.

15 changes: 15 additions & 0 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,15 @@
name: Continuous Deployment

on:
push:
branches: [main]

concurrency:
group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
cancel-in-progress: true

jobs:
verify:
name: Verify
uses: ./.github/workflows/verify.yml
secrets: inherit
Comment on lines +13 to +15

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {}

Copilot Autofix

AI about 1 month ago

To address the flagged issue, add an explicit permissions key at the workflow level (top-level, above jobs:) in .github/workflows/ci.yml. This ensures that all jobs in the workflow—unless they declare their own permissions—receive only the minimum GitHub token capabilities necessary. As a safe “minimal starting point”, set contents: read (which covers most cases where jobs only need to read from the repository). If you know exactly what permissions your workflow needs (for example, writing pull-requests), you may grant those instead. However, without further context, the minimal and safest fix is to add:

permissions:
  contents: read

Easily implementable by inserting this block above the jobs: key, between lines 10 and 11.

Suggested changeset 1
.github/workflows/ci.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -8,6 +8,8 @@
   group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
 jobs:
   verify:
     name: Verify
EOF
@@ -8,6 +8,8 @@
group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
cancel-in-progress: true

permissions:
contents: read
jobs:
verify:
name: Verify
Copilot is powered by AI and may make mistakes. Always verify output.
9 changes: 8 additions & 1 deletion .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,13 @@ on:
push:
branches:
- main
workflow_dispatch:
inputs:
run-verify:
type: boolean
description: 'Run verification after release'
required: false
default: false

concurrency: ${{ github.workflow }}-${{ github.ref }}

Expand All @@ -32,7 +39,7 @@ jobs:

verify:
needs: release
if: ${{ needs.release.outputs.pullRequestNumber != '' }}
if: ${{ inputs.run-verify && needs.release.outputs.pullRequestNumber != '' }}
uses: ./.github/workflows/verify.yml
secrets: inherit
with:
Expand Down
7 changes: 2 additions & 5 deletions .github/workflows/verify.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
name: 'Verify'
name: Verify
on:
workflow_call:
inputs:
Expand Down Expand Up @@ -44,7 +44,7 @@ jobs:

steps:
- uses: actions/checkout@v4

- name: Setup Repository
uses: ./.github/actions/setup

Expand All @@ -64,6 +64,3 @@ jobs:
if: ${{ inputs.run-acceptance }}
shell: bash
run: pnpm spec