langchain-ai/docs
1
0
Fork 0
mirror of https://github.com/langchain-ai/docs.git synced 2026-07-21 11:55:23 -04:00
Code Issues 490 Packages Projects Releases Wiki Activity

[PR #2833] [MERGED] Potential fix for code scanning alert no. 14: Workflow does not contain permissions #2928

New Issue
Closed
opened 2026-06-05 18:20:25 -04:00 by yindo · 0 comments
yindo commented 2026-06-05 18:20:25 -04:00
Owner
Copy Link
Copy Source

📋 Pull Request Information

Original PR: https://github.com/langchain-ai/docs/pull/2833
Author: @jkennedyvz
Created: 2/26/2026
Status: ✅ Merged
Merged: 2/26/2026
Merged by: @jkennedyvz

Base: main ← Head: alert-autofix-14

📝 Commits (1)

  • b493e69 Potential fix for code scanning alert no. 14: Workflow does not contain permissions

📊 Changes

1 file changed (+2 additions, -0 deletions)

View changed files

📝 .github/workflows/_check-links.yml (+2 -0)

📄 Description

Potential fix for https://github.com/langchain-ai/docs/security/code-scanning/14

In general, the fix is to add an explicit permissions block that grants only the minimal required scopes to the GITHUB_TOKEN. For this workflow, the job checks out code and builds/tests docs locally; it doesn’t interact with GitHub resources in a way that requires write access, so contents: read is sufficient.

The best change with no behavior impact is to add a permissions section under the check-links job (or at the workflow root). To keep the change narrowly scoped to the flagged area, add it to the job definition, just after runs-on: ubuntu-latest (around line 34–35). This will restrict that job’s token to read-only repository contents, which still allows actions/checkout to function and does not affect any other functionality.

No new imports, methods, or other definitions are needed; this is a pure YAML configuration update inside .github/workflows/_check-links.yml.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/langchain-ai/docs/pull/2833 **Author:** [@jkennedyvz](https://github.com/jkennedyvz) **Created:** 2/26/2026 **Status:** ✅ Merged **Merged:** 2/26/2026 **Merged by:** [@jkennedyvz](https://github.com/jkennedyvz) **Base:** `main` ← **Head:** `alert-autofix-14` --- ### 📝 Commits (1) - [`b493e69`](https://github.com/langchain-ai/docs/commit/b493e692f20b94bb266166cc4d29e26b72bafd88) Potential fix for code scanning alert no. 14: Workflow does not contain permissions ### 📊 Changes **1 file changed** (+2 additions, -0 deletions) <details> <summary>View changed files</summary> 📝 `.github/workflows/_check-links.yml` (+2 -0) </details> ### 📄 Description Potential fix for [https://github.com/langchain-ai/docs/security/code-scanning/14](https://github.com/langchain-ai/docs/security/code-scanning/14) In general, the fix is to add an explicit `permissions` block that grants only the minimal required scopes to the `GITHUB_TOKEN`. For this workflow, the job checks out code and builds/tests docs locally; it doesn’t interact with GitHub resources in a way that requires write access, so `contents: read` is sufficient. The best change with no behavior impact is to add a `permissions` section under the `check-links` job (or at the workflow root). To keep the change narrowly scoped to the flagged area, add it to the job definition, just after `runs-on: ubuntu-latest` (around line 34–35). This will restrict that job’s token to read-only repository contents, which still allows `actions/checkout` to function and does not affect any other functionality. No new imports, methods, or other definitions are needed; this is a pure YAML configuration update inside `.github/workflows/_check-links.yml`. _Suggested fixes powered by Copilot Autofix. Review carefully before merging._ --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
yindo added the pull-request label 2026-06-05 18:20:25 -04:00
yindo closed this issue 2026-06-05 18:20:26 -04:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
deepagents
docs-infra
external
external
help wanted
integration
internal
internal
javascript
js/ts
langchain
langgraph
langsmith
needs-title
pull-request
Mirrored from GitHub Pull Request
 python
reference
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: langchain-ai/docs#2928
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?