ci: grant security-events: write so the dogfood SARIF upload works#26
Conversation
The dogfood step (commit 5ee4cd0) runs dmartinochoa/pipeline-check against this repo's own .github/workflows/, then hands the resulting SARIF to github/codeql-action/upload-sarif so findings land on the repo's Security tab. The upload needs security-events: write on the GITHUB_TOKEN, but ci.yml was workflow-scoped to contents: read. PR-event runs degrade gracefully (GitHub strips write tokens from fork PRs anyway, so the action no-ops with a warning), which is why this didn't trip on the release/1.0.0 PR matrix. The first push: main trigger after that PR merged tried to upload for real and bailed with "Resource not accessible by integration". CI on 0effd7e went red as a result; the publish.yml run on v1.0.0 was unaffected (separate workflow, separate trigger, separate permission block). Workflow-level scope mirrors what codeql.yml already declares. No single step in this job writes anything else; tightening to a per-job permissions block would just duplicate the same two lines for no defence-in-depth gain. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
Warning Rate limit exceeded
You’ve run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
1 participant
Summary
Fixes the red CI on 0effd7e. The dogfood step's SARIF upload (
github/codeql-action/upload-sarif) needssecurity-events: write; ci.yml was workflow-scoped tocontents: readonly.The pipeline-check tool ran fine and the gate passed (
[gate] PASS (7 effective finding(s) evaluated)). It's purely the upload-to-Security-tab step that errored:Why the PR for v1.0.0 was green
pull_requesttriggers on fork PRs run with read-only tokens —upload-sarifdetects the missing scope and degrades silently. The release branch ran under that semantic and stayed green. The first realpush: maintrigger after the merge tried to upload for real and tripped.Scope
Two lines at workflow level, mirroring what codeql.yml already grants:
No step in the CI job writes anything other than the SARIF upload; tightening to a per-job permissions block would just duplicate the same two lines for no defence-in-depth gain.
publish.yml's permission model is independent and untouched.Test plan
push: mainrun)🤖 Generated with Claude Code