Repository navigation
Add friendly target names & use local repo for testing. - #11
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Checkout Action | ||
| uses: actions/checkout@v4 | ||
|
|
||
| - name: Checkout Test Repository | ||
| uses: actions/checkout@v4 | ||
| with: | ||
| repository: Sewer56/prs-rs | ||
| ref: 149060527e685360687d7332742ac016b39af8a7 | ||
| path: test-project | ||
|
|
||
| - name: Build with Friendly Names Enabled | ||
| uses: ./ | ||
| with: | ||
| rust-project-path: test-project/tools/cli | ||
| crate-name: prs-rs-cli | ||
| target: x86_64-unknown-linux-gnu | ||
| use-friendly-target-names: true | ||
| upload-artifacts: true | ||
|
|
||
| - name: Verify artifact name uses friendly name | ||
| shell: bash | ||
| run: | | ||
| echo "BINARY_ARTIFACT_NAME=$BINARY_ARTIFACT_NAME" | ||
| if [[ "$BINARY_ARTIFACT_NAME" != *"linux-x64"* ]]; then | ||
| echo "::error::Expected artifact name to contain 'linux-x64' but got '$BINARY_ARTIFACT_NAME'" | ||
| exit 1 | ||
| fi | ||
| if [[ "$BINARY_ARTIFACT_NAME" == *"x86_64-unknown-linux-gnu"* ]]; then | ||
| echo "::error::Expected artifact name to NOT contain raw triple 'x86_64-unknown-linux-gnu' but got '$BINARY_ARTIFACT_NAME'" | ||
| exit 1 | ||
| fi | ||
| echo "Artifact name correctly uses friendly name: $BINARY_ARTIFACT_NAME" |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium test
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 11 months ago
The best way to fix this issue is to explicitly specify a permissions block at the workflow or job level to restrict the GITHUB_TOKEN permissions to the minimum required for this workflow―in this case, contents: read should suffice, since the job only checks out repos, runs test scripts, and verifies artifact naming, but does not appear to modify issues, pull requests, or repository contents. The permissions block can be added either at the root of the workflow file (to apply globally), or inside the test-friendly-names-enabled job definition on line 21 (applying just to the job). To follow the least privilege principle and the recommendations, add the following block above jobs: at line 20:
permissions:
contents: readNo additional methods, imports, or definitions are needed to implement the fix.
| @@ -17,6 +17,8 @@ | ||
| - "scripts/get-friendly-target-name.sh" | ||
| - ".github/workflows/test-friendly-names.yml" | ||
|
|
||
| permissions: | ||
| contents: read | ||
| jobs: | ||
| test-friendly-names-enabled: | ||
| runs-on: ubuntu-latest |
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Checkout Action | ||
| uses: actions/checkout@v4 | ||
|
|
||
| - name: Checkout Test Repository | ||
| uses: actions/checkout@v4 | ||
| with: | ||
| repository: Sewer56/prs-rs | ||
| ref: 149060527e685360687d7332742ac016b39af8a7 | ||
| path: test-project | ||
|
|
||
| - name: Build with Friendly Names Disabled | ||
| uses: ./ | ||
| with: | ||
| rust-project-path: test-project/tools/cli | ||
| crate-name: prs-rs-cli | ||
| target: x86_64-unknown-linux-gnu | ||
| use-friendly-target-names: false | ||
| upload-artifacts: true | ||
|
|
||
| - name: Verify artifact name uses raw triple | ||
| shell: bash | ||
| run: | | ||
| echo "BINARY_ARTIFACT_NAME=$BINARY_ARTIFACT_NAME" | ||
| if [[ "$BINARY_ARTIFACT_NAME" != *"x86_64-unknown-linux-gnu"* ]]; then | ||
| echo "::error::Expected artifact name to contain raw triple 'x86_64-unknown-linux-gnu' but got '$BINARY_ARTIFACT_NAME'" | ||
| exit 1 | ||
| fi | ||
| echo "Artifact name correctly uses raw triple: $BINARY_ARTIFACT_NAME" |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium test
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 11 months ago
To fix this problem, you should add a permissions block to the workflow and set it to the minimum necessary privileges—contents: read—at the root level of your workflow YAML. This restricts the GITHUB_TOKEN permissions for all jobs in the workflow, following GitHub’s best practices.
To implement the change, insert the following lines right after the name: line near the top (before on:):
permissions:
contents: readThis modification ensures the workflow can check out code and access metadata, but cannot write to the repository or perform any privileged actions.
| @@ -1,4 +1,6 @@ | ||
| name: Test Friendly Target Names (Disabled) | ||
| permissions: | ||
| contents: read | ||
|
|
||
| on: | ||
| workflow_dispatch: |
614564d to
085ab4a
Compare
Sewer56
changed the title
- Introduced use-friendly-target-names input (default: false) for human-readable artifact names - Created mapping script with 160 explicit target-to-friendly-name transformations (O(1) lookup) - Updated artifact name generation to conditionally use friendly names (e.g., x86_64-unknown-linux-gnu -> linux-x64) - Added comprehensive test workflow covering script validation and end-to-end action behavior - Updated: Test workflows to use local action instead of remote reference - Updated: Use env vars for artifact names in symbol tests - Updated: Add missing pgo-project-path to PGO test jobs - Updated: Remove workspace-path from standalone CLI builds
af88d8d to
93c6949
Compare
2 participants
No description provided.