Grant CI workflows the write scopes Dependabot PRs need - #2553
Merged
Conversation
Dependabot-triggered runs get a read-only GITHUB_TOKEN unless the workflow declares permissions, so every Dependabot PR failed at the first step that needed write access: publish-unit-test-result-action and eslint-annotate-action got 403 on POST /check-runs, and the ghcr.io image push had no packages scope. Permissions can only be narrowed down a reusable-workflow chain, so the callers have to grant at least what the called workflow asks for. Also stop Dependabot from touching the FwHeadless dotnet8 stage: it "bumps" 8.0 to 10.0 by deleting the stage, which leaves COPY --from=dotnet8 resolving to a non-existent docker.io/library/dotnet8 image (#2521). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (9)
📝 WalkthroughWalkthroughThe PR adds a Dependabot ignore rule for the headless firmware runtime image and declares explicit permissions for build, validation, deployment, and package-publishing GitHub Actions jobs. ChangesCI configuration
Estimated code review effort: 2 (Simple) | ~10 minutes Mergeability Score: ⚪ Minimal · up to This PR updates CI permissions and Dependabot configuration; no actionable merge-blocking risk remains after normal checks and review. Possibly related PRs
Suggested labels: Suggested reviewers: Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
One rule: every write scope names the step that needs it; nothing else. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
… on forks The 8.0 tag floats over patches anyway, so only the major jump needs blocking. The fork guard matches lexbox-api/ui, which already skip login+push there. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Last image workflow with its own pull_request trigger and no fork guard. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Not risk-free: setup-k8s pulls lexbox-fw-headless:<version> with continue-on-error and only repoints the kustomization on success, so skipping the push makes a fork PR's integration tests run against develop's image and report green. Keeping the red build until that's addressed on its own. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
myieye
changed the title
hahn-kev
approved these changes
Aug 14, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The main risk of this PR is probably that images can be pushed with arbitrary package versions.
Dependabot runs get a read-only
GITHUB_TOKENunless the workflow asks for more, and none of these workflows declaredpermissionsat all. So every Dependabot PR died at the first step needing write access:403 Resource not accessible by integrationonPOST /check-runs, and nopackagesscope for the ghcr.io push.Also makes dependabot ignore
mcr.microsoft.com/dotnet/runtimemajors in/backend/FwHeadless, because ChorusMerge needs 8.0 (see #2554 & #2521).