Skip to content

Conversation

@arunshenoy99
Copy link
Member

@arunshenoy99 arunshenoy99 commented Oct 16, 2025

Proposed changes

These were skipped as part of the BH plugin re-design. WIP PR to get these working again.

Type of Change

Production

  • Bugfix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)
  • Dependency update
  • Refactoring / housekeeping (changes to files not directly related to functionality)

Development

  • Tests
  • Dependency update
  • Environment update / refactoring
  • Documentation Update

Visual

Checklist

  • I have read the CONTRIBUTING doc
  • I have viewed my change in a web-browser
  • Linting and tests pass locally with my changes
  • I have added tests that prove my fix is effective or that my feature works
  • I have added necessary documentation (if appropriate)

Further comments

@arunshenoy99 arunshenoy99 requested a review from a team as a code owner October 16, 2025 12:31
Comment on lines +67 to +74
mojo:
name: Mojo Build and Test
needs: setup
uses: newfold-labs/workflows/.github/workflows/module-plugin-test.yml@main
with:
module-repo: ${{ github.repository }}
module-branch: ${{ needs.setup.outputs.branch }}
plugin-repo: 'newfold-labs/wp-plugin-mojo'

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {}

Copilot Autofix

AI 2 months ago

To fix this problem, you should explicitly set the permissions key in your workflow YAML to restrict the permissions of the GITHUB_TOKEN. The safest and easiest way is to set the permissions key at the top level of the workflow file, just after the workflow name and before on:. This will apply the specified permissions to all jobs unless overridden by individual permissions keys under specific jobs. If all jobs (including setup) only require read-only access to repo contents and do not need to write or modify anything, you should use contents: read as the minimal permission. If future jobs require additional permissions, you can add those specifically. For now, set:

permissions:
  contents: read

at the top of the workflow file to minimize risk.


Suggested changeset 1
.github/workflows/brand-plugin-test.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/brand-plugin-test.yml b/.github/workflows/brand-plugin-test.yml
--- a/.github/workflows/brand-plugin-test.yml
+++ b/.github/workflows/brand-plugin-test.yml
@@ -1,4 +1,6 @@
 name: Build and Test Module Updates in Brand Plugins
+permissions:
+  contents: read
 on:
   pull_request:
     types: [ opened, reopened, ready_for_review, synchronize ]
EOF
@@ -1,4 +1,6 @@
name: Build and Test Module Updates in Brand Plugins
permissions:
contents: read
on:
pull_request:
types: [ opened, reopened, ready_for_review, synchronize ]
Copilot is powered by AI and may make mistakes. Always verify output.
@github-actions
Copy link
Contributor

@arunshenoy99 arunshenoy99 added the In progress Developer is working on, stop with review label Oct 16, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

In progress Developer is working on, stop with review

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants