Skip to content

Conversation

juliannguyen4
Copy link
Collaborator

No description provided.

@codecov-commenter
Copy link

codecov-commenter commented Aug 29, 2025

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 81.91%. Comparing base (f762c03) to head (cab272e).
⚠️ Report is 7 commits behind head on dev.

Additional details and impacted files
@@            Coverage Diff             @@
##              dev     #826      +/-   ##
==========================================
- Coverage   82.03%   81.91%   -0.12%     
==========================================
  Files          99       99              
  Lines       14724    14024     -700     
==========================================
- Hits        12079    11488     -591     
+ Misses       2645     2536     -109     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Comment on lines 30 to 40
needs: rebuild-artifacts-with-new-dev-num
name: Get Jfrog project to store artifacts
runs-on: ubuntu-24.04
outputs:
jfrog-project: ${{ steps.get-jfrog-project.outputs.jfrog_project }}

steps:
- id: get-jfrog-project
run: echo jfrog_project=${{ env.JFROG_PYTHON_CLIENT_PROJECT }} >> $GITHUB_OUTPUT

upload-github-artifacts-to-jfrog:

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {}

Copilot Autofix

AI about 1 month ago

To fix the problem, add a permissions key to the root level of the workflow file (.github/workflows/dev-workflow-p2.yml). This key should set the least necessary privileges required for the workflow to function. At a minimum, set contents: read, and add more granular permissions only if a job requires them (such as pull-requests: write if you manage PRs, or issues: write if you open/modify issues). Since most jobs reuse other workflows and interact mostly with artifacts, no write permissions are obviously required for contents, so start with just contents: read. If upon workflow usage additional permissions errors arise, add the minimum necessary permissions for each required type.

Edit .github/workflows/dev-workflow-p2.yml and insert a permissions block at the top level, directly after the name: field and before on:. For now, only set contents: read.

Suggested changeset 1
.github/workflows/dev-workflow-p2.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/dev-workflow-p2.yml b/.github/workflows/dev-workflow-p2.yml
--- a/.github/workflows/dev-workflow-p2.yml
+++ b/.github/workflows/dev-workflow-p2.yml
@@ -1,4 +1,6 @@
 name: Dev workflow (part 2)
+permissions:
+  contents: read
 
 on:
   pull_request_target:
EOF
@@ -1,4 +1,6 @@
name: Dev workflow (part 2)
permissions:
contents: read

on:
pull_request_target:
Copilot is powered by AI and may make mistakes. Always verify output.
Comment on lines +56 to +82
needs: [
bump-dev-number,
get-jfrog-project-to-store-artifacts,
upload-github-artifacts-to-jfrog
]
uses: aerospike/shared-workflows/.github/workflows/reusable_create-release-bundle.yaml@34ffd4613504a792f3cd5530c69fb9a3115ad9c1
with:
project: ${{ needs.get-jfrog-project-to-store-artifacts.outputs.jfrog-project }}
build-names: "${{ needs.get-jfrog-project-to-store-artifacts.outputs.jfrog-build-name }}:${{ needs.bump-dev-number.outputs.new_version }}"
bundle-name: asdf
version: ${{ needs.bump-dev-number.outputs.new_version }}

# upload-to-jfrog:
# name: Upload artifacts to JFrog
# needs: [
# bump-dev-number,
# rebuild-artifacts-with-new-dev-num
# ]
# uses: ./.github/workflows/upload-to-jfrog.yml
# with:
# version: ${{ needs.bump-dev-number.outputs.new_version }}
# secrets: inherit

# We don't want the artifacts in JFrog to also exist in Github
delete-artifacts:
needs: upload-to-jfrog
uses: ./.github/workflows/delete-artifacts.yml
# delete-artifacts:
# needs: upload-to-jfrog
# uses: ./.github/workflows/delete-artifacts.yml

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {}

Copilot Autofix

AI about 1 month ago

The best fix is to add an explicit permissions block as early as possible in the workflow YAML file, typically just below the name: and before the on: key (which will apply to all jobs that do not specify their own permissions block). The permissions block should specify only those privileges required by the workflow (preferably contents: read unless the jobs require additional write privileges, such as contents: write or issues: write). Since the workflow is handling artifact uploads, version bumps, and possibly PR-related changes, it's safe to start with contents: read and grant more if needed after a functional test. As required and as a minimal baseline, the recommended block is:

permissions:
  contents: read

You can later strengthen or refine this if the workflow needs more (such as pull-requests: write).

What to do:

  • In .github/workflows/dev-workflow-p2.yml, insert a permissions: block after the name: field, before the on: block (after line 1).
  • Use the recommended minimal setting: contents: read.

No imports or new methods are required for this change, as it is a configuration edit.


Suggested changeset 1
.github/workflows/dev-workflow-p2.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/dev-workflow-p2.yml b/.github/workflows/dev-workflow-p2.yml
--- a/.github/workflows/dev-workflow-p2.yml
+++ b/.github/workflows/dev-workflow-p2.yml
@@ -1,4 +1,6 @@
 name: Dev workflow (part 2)
+permissions:
+  contents: read
 
 on:
   pull_request_target:
EOF
@@ -1,4 +1,6 @@
name: Dev workflow (part 2)
permissions:
contents: read

on:
pull_request_target:
Copilot is powered by AI and may make mistakes. Always verify output.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants