You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
ci: scope workflow token permissions and pin dependencies - #1239
I used Claud Code to tell me what was needed and explain why they were needed to me.
Changes:
Permissions: nightly.yml, release.yml and sponsors.yml now give only contents: read at the top level. Write access is granted per job: create-release and update-release can write contents, image-build* can write packages and read contents, and image-merge* can write packages.
The extra contents: read blocks are due to it replacing the root permissions configuration, so any changes are both consistent and explicit. e2e.yml gets a top-level contents: read block, which it didn’t have before.
Pins: sqlc-dev/setup-sqlc in ci.yml:32 is now pinned to the SHA of v5.0.0.
The node, alpine and distroless base images in Dockerfile, Dockerfile.distroless and frontend/Dockerfile.dev are pinned to digests. (Note that the :latest tag changing will still download by the digest, but Dependabot will open a PR to update the digest when it changes.)
Each digest is the multi-arch index, so arm64 builds still work.
Dependabot: dependabot.yml now covers /e2e for npm and /frontend for docker.
Because of the changes to the nightly action it might be worth triggering a manual run after merging to check it all works properly.
If my counting is right this should fix 16 Dependabot issues (but may open some new ones to update things).
Summary by CodeRabbit
Chores
Automated dependency updates now cover the frontend and end-to-end test directories, alongside the existing root-level Docker updates.
Build, release, nightly, and sponsor workflows now specify permissions at the workflow or job level, with write access limited to jobs that need it.
Build environments use base images pinned to specific versions and digests, making the selected images consistent across builds.
- set read-only top-level permissions on all workflows and grant
write access per job only where needed (release, nightly, sponsors)
- add missing permissions block to the e2e workflow
- pin sqlc-dev/setup-sqlc to a commit sha
- pin node, alpine and distroless base images to digests
- let dependabot cover /e2e (npm) and /frontend (docker)
No actionable comments were generated in the recent review.
Walkthrough
The changes update Dependabot directory coverage, pin the sqlc setup action and container base images, and define workflow permissions globally and for selected jobs.
Changes: Repository automation and build configuration
Layer / File(s)
Summary
Dependency coverage and action reference .github/dependabot.yml, .github/workflows/ci.yml
Dependabot configuration adds /e2e to npm updates and /frontend to Docker updates. The CI workflow pins sqlc-dev/setup-sqlc to a commit.
The change tightens CI token permissions and pins dependencies. No concrete merge-blocking risk was identified. Running the nightly workflow after merge, as the author suggests, would confirm the new permission scopes.
Pre-merge checks: 4
Check name
Status
Explanation
Description Check
Check skipped - CodeRabbit’s high-level summary is enabled.
Title check
The title "ci: scope workflow token permissions and pin dependencies" matches the main changes. The workflows now set explicit least-privilege GITHUB_TOKEN permissions at workflow and job scope, and t…
Linked Issues check
Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check
Check skipped because no linked issues were found for this pull request.
Full details: Title check
Explanation
The title "ci: scope workflow token permissions and pin dependencies" matches the main changes. The workflows now set explicit least-privilege GITHUB_TOKEN permissions at workflow and job scope, and the diff pins sqlc-dev/setup-sqlc, the Dockerfile base images, and related images to digests. Dependabot coverage is also expanded, which the title does not mention, but that is a secondary detail.
Finishing Touches
Generate unit tests (beta)
Commit to this branch
Create a new PR
Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Reviewing files that changed from the base of the PR and between 6dfdcf0 and 16d006c.
Files selected for processing: 9
.github/dependabot.yml
.github/workflows/ci.yml
.github/workflows/e2e.yml
.github/workflows/nightly.yml
.github/workflows/release.yml
.github/workflows/sponsors.yml
Dockerfile
Dockerfile.distroless
frontend/Dockerfile.dev
Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 7 remain after this review.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
These are all fixes for suggestions from Dependabot / Code Scanning.
I used Claud Code to tell me what was needed and explain why they were needed to me.
Changes:
nightly.yml,release.ymlandsponsors.ymlnow give onlycontents: readat the top level. Write access is granted per job:create-releaseandupdate-releasecan write contents,image-build*can write packages and read contents, andimage-merge*can write packages.The extra
contents: readblocks are due to it replacing the root permissions configuration, so any changes are both consistent and explicit.e2e.ymlgets a top-levelcontents: readblock, which it didn’t have before.sqlc-dev/setup-sqlcinci.yml:32is now pinned to the SHA of v5.0.0.The node, alpine and distroless base images in Dockerfile, Dockerfile.distroless and frontend/Dockerfile.dev are pinned to digests. (Note that the
:latesttag changing will still download by the digest, but Dependabot will open a PR to update the digest when it changes.)Each digest is the multi-arch index, so arm64 builds still work.
/e2efor npm and/frontendfor docker.Because of the changes to the nightly action it might be worth triggering a manual run after merging to check it all works properly.
If my counting is right this should fix 16 Dependabot issues (but may open some new ones to update things).
Summary by CodeRabbit