Uh oh!
There was an error while loading. Please reload this page.
Revert "Remove actions: write from triage workflow" - #272
Conversation
This reverts commit 978211f.
Warning Review limit reached
Next review available in:51 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Pull request overview
This PR reverts changes from #271 in the reusable issue/PR triage workflow by restoring broader GitHub token permissions and reverting the pinned actions/ai-inference action revision.
Changes:
- Restores
actions: writepermission to the reusable triage workflow. - Reverts
actions/ai-inferencefrom a v3 pin back to a v2 pin (in two job steps).
Suppressed comments (1)
.github/workflows/reusable-issue-triage.yml:269
- This change downgrades
actions/ai-inferencefrom the previously pinned v3 SHA to a v2 SHA. If the goal of this PR is only to restore the removedactions: writepermission, this extra version change is surprising and could reintroduce older behavior or security issues. Please confirm the downgrade is intentional and (if not) keep the v3 pin.
- name: Analyze with AI
id: ai-triage
uses: actions/ai-inference@a7805884c80886efc241e94a5351df715968a0ad # v2
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| permissions: | ||
| issues: write | ||
| pull-requests: write | ||
| actions: write | ||
| contents: read |
| - name: Analyze with AI | ||
| id: ai-triage | ||
| uses: actions/ai-inference@2c43c91ae16266ca159d311430343c67a5ffa222 # v3 | ||
| uses: actions/ai-inference@a7805884c80886efc241e94a5351df715968a0ad # v2 |
Addresses findings from a security review of this repository. These workflows are consumed by ~45 repositories in the organization, so changes here apply org-wide. Add SECURITY.md This repository provides the organization's default community health files, but had no security policy, so no wp-cli repository surfaced a "Report a vulnerability" path. Points at the WP-CLI handbook and the WordPress HackerOne program rather than restating policy that lives elsewhere. Scope `actions: write` to the job that needs it It was declared at workflow level, so it also reached `triage-new-item`, which runs on `pull_request_target` and processes pull request titles and bodies written by anyone who can open a PR. `actions: write` permits dispatching workflows and deleting caches and artifacts, a known lateral-movement path. Only `triage-unlabeled-items` needs it, and that job is `workflow_dispatch`-only. The grant has to stay in the caller, since a caller can only cap a reusable workflow's permissions and never raise them; removing it there is what broke dispatching in #271 and prompted the revert in #272. Comments in both files record this so the next attempt narrows rather than removes. Pin the two unpinned CI dependencies `docker://rhysd/actionlint:latest` is built from upstream `main`, not from a release: its digest differs from the 1.7.9 tag. Pinned by digest instead. Dependabot does not track `docker://` references, so this needs manual bumps. `npx --yes gherkin-lint` resolved and executed the newest publish on every run. The package was last released in December 2023 and has two maintainers, so a single account compromise would reach CI in every repository. Pinned to 4.2.4. Correct the actions/setup-node pin comment The pinned SHA is v7.0.0, but the trailing comment read v6. The pin itself is immutable and current; the comment is what reviewers read, so a wrong one quietly defeats the point of the convention. Fail the WP-CLI download loudly `curl -O` without `-f` writes the error body to the file and still exits 0, so an outage installed an HTML page as /usr/local/bin/wp and surfaced as a confusing failure much later. Reduce blast radius of the workflow sync SKIP_DELETE stops a pattern change from deleting files across every target repository. The FILE_PATTERNS regexes now escape their dots so they match only the intended paths. Both jobs drop to `contents: read`, since the sync authenticates with ACTIONS_BOT and never uses GITHUB_TOKEN to write. The schedule drops from every ten minutes to hourly; pushes to the default branch still sync immediately.
Addresses findings from a security review of this repository. These workflows are consumed by ~45 repositories in the organization, so changes here apply org-wide. Rebased onto #274, which independently pinned actionlint by digest and added `--fail` to the two curl calls in the code quality workflow. Those parts of the review are covered by that change and are dropped here; #274's actionlint pin resolves to the linux/amd64 manifest of v1.7.11, which is correct for the GitHub-hosted runners these jobs use. Add SECURITY.md This repository provides the organization's default community health files, but had no security policy, so no wp-cli repository surfaced a "Report a vulnerability" path. Points at the WP-CLI handbook and the WordPress HackerOne program rather than restating policy that lives elsewhere. Scope `actions: write` to the job that needs it It was declared at workflow level, so it also reached `triage-new-item`, which runs on `pull_request_target` and processes pull request titles and bodies written by anyone who can open a PR. `actions: write` permits dispatching workflows and deleting caches and artifacts, a known lateral-movement path. Only `triage-unlabeled-items` needs it, and that job is `workflow_dispatch`-only. The grant has to stay in the caller, since a caller can only cap a reusable workflow's permissions and never raise them; removing it there is what broke dispatching in #271 and prompted the revert in #272. Comments in both files record this so the next attempt narrows rather than removes. Pin gherkin-lint `npx --yes gherkin-lint` resolved and executed the newest publish on every run. The package was last released in December 2023 and has two maintainers, so a single account compromise would reach CI in every repository. Correct the actions/setup-node pin comment The pinned SHA is v7.0.0, but the trailing comment read v6. The pin itself is immutable and current; the comment is what reviewers read, so a wrong one quietly defeats the point of the convention. Fail the WP-CLI download loudly `curl -O` without `-f` writes the error body to the file and still exits 0, so an outage installed an HTML page as /usr/local/bin/wp and surfaced as a confusing failure much later. Reduce blast radius of the workflow sync SKIP_DELETE stops a pattern change from deleting files across every target repository. The FILE_PATTERNS regexes now escape their dots so they match only the intended paths. Both jobs drop to `contents: read`: the sync authenticates with ACTIONS_BOT, and the action reads that token from its `with:` input and makes no API calls, so GITHUB_TOKEN is never used at all.
Reverts #271