feat: add provider checks #723
Open
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Datron
force-pushed
the
provider-checks
branch
from
97691a8 to
70f96b7
Compare
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Comment on lines
232
to
327
| name: Provider Tests | ||
| runs-on: codebuild-superposition-${{ github.run_id }}-${{ github.run_attempt }} | ||
| strategy: | ||
| matrix: | ||
| provider: | ||
| - kotlin | ||
| # - js | ||
| # - py | ||
| services: | ||
| postgres: | ||
| image: public.ecr.aws/docker/library/postgres:15-alpine3.21 | ||
| ports: | ||
| - 5432:5432 | ||
| env: | ||
| POSTGRES_PASSWORD: "docker" | ||
| POSTGRES_DB: "config" | ||
| restart: on-failure | ||
| volumes: | ||
| - ./docker-compose/postgres/data:/var/lib/postgresql/data | ||
|
|
||
| steps: | ||
| - name: Checkout repository | ||
| uses: actions/checkout@v4 | ||
| with: | ||
| fetch-depth: 0 | ||
|
|
||
| - name: Install postgres libs | ||
| run: | | ||
| sudo apt-get -y install postgresql libpq-dev | ||
| - name: Install Bun | ||
| uses: oven-sh/setup-bun@v2 | ||
|
|
||
| - name: make binary executable | ||
| run: chmod +x scripts/setup_provider_binaries.sh | ||
|
|
||
| - name: Restore cache (if present) | ||
| uses: actions/cache/restore@v4 | ||
| id: cache-restore | ||
| with: | ||
| path: | | ||
| ~/.cargo/bin/ | ||
| ~/.cargo/registry/index/ | ||
| ~/.cargo/registry/cache/ | ||
| ~/.cargo/git/db/ | ||
| target/ | ||
| key: ${{ runner.os }}-cargo-test-${{ hashFiles('**/Cargo.lock') }} | ||
| restore-keys: ${{ runner.os }}-cargo-test- | ||
|
|
||
| - name: Install Rust | ||
| uses: dtolnay/rust-toolchain@master | ||
| with: | ||
| toolchain: 1.86.0 | ||
| targets: wasm32-unknown-unknown | ||
| components: rustfmt, clippy | ||
|
|
||
| - name: Set up JDK 17 (for Kotlin tests) | ||
| if: matrix.provider == 'kotlin' | ||
| uses: actions/setup-java@v4 | ||
| with: | ||
| java-version: "17" | ||
| distribution: "temurin" | ||
|
|
||
| - name: Make gradlew executable | ||
| if: matrix.provider == 'kotlin' | ||
| run: chmod +x clients/java/gradlew | ||
|
|
||
| - name: Run Gradle assemble | ||
| if: matrix.provider == 'kotlin' | ||
| run: cd clients/java && ./gradlew assemble | ||
|
|
||
| - name: Install Node.js (for JS tests) | ||
| if: matrix.provider == 'js' | ||
| uses: actions/setup-node@v4 | ||
| with: | ||
| node-version: 18.19.0 | ||
|
|
||
| - name: Set up Python (for Python tests) | ||
| if: matrix.provider == 'py' | ||
| uses: actions/setup-python@v6 | ||
| with: | ||
| python-version: "3.12" | ||
|
|
||
| - name: Install uv | ||
| if: matrix.provider == 'py' | ||
| uses: astral-sh/setup-uv@v3 | ||
| with: | ||
| version: "latest" | ||
|
|
||
| - name: Run provider tests | ||
| if: matrix.provider != 'py' | ||
| shell: bash | ||
| run: | | ||
| cargo build --package superposition_core | ||
| make test-${{ matrix.provider }}-provider | ||
| env: | ||
| APP_ENV: "TEST" | ||
|
|
||
| - name: Run provider tests | ||
| if: matrix.provider == 'py' | ||
| shell: bash | ||
| run: | | ||
| cargo build --package superposition_core | ||
| export UV_PROJECT_ENVIRONMENT="${pythonLocation}" | ||
| make test-${{ matrix.provider }}-provider | ||
| env: | ||
| APP_ENV: "TEST" |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI about 12 hours ago
To fix this problem, add an explicit permissions block to the provider-tests job in .github/workflows/ci_check_pr.yaml. Based on the steps it runs (installing dependencies, running tests, using caches), it appears that only read permissions to contents are required—no steps modify repo contents, pull-requests, or issues. So add:
permissions:
contents: readdirectly under the provider-tests: job definition (after line 232). This ensures that the job's GITHUB_TOKEN is restricted and adheres to least privilege. No further changes or imports are needed.
Suggested changeset
1
.github/workflows/ci_check_pr.yaml
| @@ -230,6 +230,8 @@ | ||
|
|
||
| provider-tests: | ||
| name: Provider Tests | ||
| permissions: | ||
| contents: read | ||
| runs-on: codebuild-superposition-${{ github.run_id }}-${{ github.run_attempt }} | ||
| strategy: | ||
| matrix: |
Copilot is powered by AI and may make mistakes. Always verify output.
Datron
force-pushed
the
provider-checks
branch
4 times, most recently
from
b16612b to
9fe647a
Compare
Datron
force-pushed
the
provider-checks
branch
10 times, most recently
from
cfcd327 to
209d211
Compare
Datron
force-pushed
the
provider-checks
branch
from
209d211 to
424a0b9
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Problem
Missing checks for provider made it hard to make changes to our FFI, sdk and provider layers to support multiple languages
Solution
Add provider checks that run in a PR to validate any FFI and provider changes