langchain-ai/helm
1
0
Fork 0
mirror of https://github.com/langchain-ai/helm.git synced 2026-07-23 07:05:24 -04:00
Code Issues 24 Packages Projects Releases 10 Wiki Activity

[PR #554] [MERGED] fix: Workflow does not contain permissions #556

New Issue
Closed
opened 2026-02-16 02:16:39 -05:00 by yindo · 0 comments
yindo commented 2026-02-16 02:16:39 -05:00
Owner
Copy Link
Copy Source

📋 Pull Request Information

Original PR: https://github.com/langchain-ai/helm/pull/554
Author: @jkennedyvz
Created: 1/9/2026
Status: ✅ Merged
Merged: 1/13/2026
Merged by: @jkennedyvz

Base: main ← Head: alert-autofix-1

📝 Commits (2)

  • 31ae278 fix: Workflow does not contain permissions
  • 6b2a29a Potential fix for code scanning alert no. 5: Workflow does not contain permissions

📊 Changes

2 files changed (+5 additions, -0 deletions)

View changed files

📝 .github/workflows/helm_checks.yaml (+3 -0)
📝 .github/workflows/test_docker_compose.yml (+2 -0)

📄 Description

Potential fix for https://github.com/langchain-ai/helm/security/code-scanning/1

In general, to fix this class of problem you explicitly declare a permissions: block at the workflow or job level, granting only the scopes that the job actually needs. This prevents the GITHUB_TOKEN from defaulting to broad repository permissions (possibly including write access) and aligns with least‑privilege principles.

For this specific workflow, the docker-compose job only checks out the repository and runs local Docker Compose commands. It does not create or modify issues, pull requests, or repository contents. The minimal required permission is therefore read access to repository contents so that actions/checkout can function. The best fix is to add a permissions: block to the docker-compose job, directly under the job name, setting contents: read. This avoids changing behavior (checkout still works), while ensuring the token cannot be used for write operations.

Concretely, in .github/workflows/test_docker_compose.yml, under jobs:, within the docker-compose: job definition and above timeout-minutes: 10, insert:

    permissions:
      contents: read

No additional imports or definitions are needed; this is purely a YAML configuration change in the workflow file.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/langchain-ai/helm/pull/554 **Author:** [@jkennedyvz](https://github.com/jkennedyvz) **Created:** 1/9/2026 **Status:** ✅ Merged **Merged:** 1/13/2026 **Merged by:** [@jkennedyvz](https://github.com/jkennedyvz) **Base:** `main` ← **Head:** `alert-autofix-1` --- ### 📝 Commits (2) - [`31ae278`](https://github.com/langchain-ai/helm/commit/31ae2785c1c16f9f1bee0272a35ecc0661f9e492) fix: Workflow does not contain permissions - [`6b2a29a`](https://github.com/langchain-ai/helm/commit/6b2a29a2bfd2d0768e3ec2fecf19879c72efdaba) Potential fix for code scanning alert no. 5: Workflow does not contain permissions ### 📊 Changes **2 files changed** (+5 additions, -0 deletions) <details> <summary>View changed files</summary> 📝 `.github/workflows/helm_checks.yaml` (+3 -0) 📝 `.github/workflows/test_docker_compose.yml` (+2 -0) </details> ### 📄 Description Potential fix for [https://github.com/langchain-ai/helm/security/code-scanning/1](https://github.com/langchain-ai/helm/security/code-scanning/1) In general, to fix this class of problem you explicitly declare a `permissions:` block at the workflow or job level, granting only the scopes that the job actually needs. This prevents the GITHUB_TOKEN from defaulting to broad repository permissions (possibly including write access) and aligns with least‑privilege principles. For this specific workflow, the `docker-compose` job only checks out the repository and runs local Docker Compose commands. It does not create or modify issues, pull requests, or repository contents. The minimal required permission is therefore read access to repository contents so that `actions/checkout` can function. The best fix is to add a `permissions:` block to the `docker-compose` job, directly under the job name, setting `contents: read`. This avoids changing behavior (checkout still works), while ensuring the token cannot be used for write operations. Concretely, in `.github/workflows/test_docker_compose.yml`, under `jobs:`, within the `docker-compose:` job definition and above `timeout-minutes: 10`, insert: ```yaml permissions: contents: read ``` No additional imports or definitions are needed; this is purely a YAML configuration change in the workflow file. _Suggested fixes powered by Copilot Autofix. Review carefully before merging._ --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
yindo added the pull-request label 2026-02-16 02:16:39 -05:00
yindo closed this issue 2026-02-16 02:16:39 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
pull-request
Mirrored from GitHub Pull Request
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: langchain-ai/helm#556
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?