Skip to content

fix: audit workflow permissions across Actions files #328

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
welshDog merged 1 commit into from
Jul 15, 2026
Merged

fix: audit workflow permissions across Actions files #328

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 15 additions & 1 deletion .github/dependabot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,21 @@
version: 2

updates:

permissions:
contents: read
on:
read
on:
push:
branches: [main, master]
pull_request:
branches: [main, master]
workflow_dispatch:
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
jobs:
lint:
Comment on lines +7 to +21

@coderabbitai coderabbitai Bot Jul 15, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🔴 Critical | ⚡ Quick win

Remove invalid GitHub Actions syntax from the Dependabot configuration.

GitHub Actions workflow syntax (such as permissions, on, concurrency, and jobs) has been mistakenly added to this file. The .github/dependabot.yml file uses a strict schema that does not support these keys, and their presence will cause parsing to fail, breaking Dependabot updates entirely. Furthermore, there are duplicate and malformed on: keys.

Please remove these lines completely, as they are only valid inside workflow files (e.g. .github/workflows/*.yml).

🐛 Proposed fix to remove the invalid configuration 
-  permissions:
-    contents: read
-  on:
-    read
-  on:
-    push:
-      branches: [main, master]
-    pull_request:
-      branches: [main, master]
-    workflow_dispatch:
-  concurrency:
-    group: ${{ github.workflow }}-${{ github.ref }}
-    cancel-in-progress: true
-  jobs:
-    lint:
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
permissions:
contents: read
on:
read
on:
push:
branches: [main, master]
pull_request:
branches: [main, master]
workflow_dispatch:
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
jobs:
lint:
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/dependabot.yml around lines 7 - 21, Remove the GitHub Actions
workflow keys from .github/dependabot.yml, including permissions, both on
entries, concurrency, and jobs with its lint block; retain only valid Dependabot
configuration entries.

# ── Python (pip) ──────────────────────────────────────────
- package-ecosystem: "pip"
directory: "/"
Expand Down
3 changes: 2 additions & 1 deletion .github/workflows/accessibility.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,8 @@ on:
schedule:
- cron: "0 2 * * *"
workflow_dispatch:

permissions:
contents: read
jobs:
a11y-dashboard:
runs-on: ubuntu-latest
Expand Down
3 changes: 2 additions & 1 deletion .github/workflows/ci-cd.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,8 @@ on:
branches: [main]
pull_request:
branches: [main]

permissions:
contents: read
concurrency:
group: ci-cd-${{ github.ref }}
cancel-in-progress: true
Expand Down
3 changes: 2 additions & 1 deletion .github/workflows/ci-integration.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,8 @@ name: \uD83D\uDD17 Integration Tests

on:
workflow_dispatch:

permissions:
contents: read
jobs:
integration:
name: Integration Tests
Expand Down
4 changes: 4 additions & 0 deletions .github/workflows/ci-js.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,10 @@ name: JS CI

on:
workflow_call:
inputs:

permissions:
contents: read
Comment on lines +5 to +8

@coderabbitai coderabbitai Bot Jul 15, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

git ls-files .github/workflows/ci-js.yml
echo '---'
cat -n .github/workflows/ci-js.yml | sed -n '1,80p'

Repository: welshDog/HyperCode-V2.4

Length of output: 3472

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Check GitHub Actions schema docs in the workflow file context if needed
rg -n "permissions|workflow_call|inputs|secrets|outputs" .github/workflows/ci-js.yml

Repository: welshDog/HyperCode-V2.4

Length of output: 1560

🏁 Script executed:

#!/bin/bash
set -euo pipefail

python3 - <<'PY'
from pathlib import Path
p=Path('.github/workflows/ci-js.yml')
print(p.exists())
if p.exists():
    txt=p.read_text()
    print(txt)
PY

Repository: welshDog/HyperCode-V2.4

Length of output: 4089

🏁 Script executed:

#!/bin/bash
set -euo pipefail

cat -n .github/workflows/ci-js.yml | sed -n '1,80p'

Repository: welshDog/HyperCode-V2.4

Length of output: 3440

Move permissions out of workflow_call. on.workflow_call only supports inputs, secrets and outputs; the stray empty inputs: entry here should go too so the reusable workflow parses cleanly.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ci-js.yml around lines 5 - 8, Update the workflow
configuration by removing the empty inputs entry from the workflow_call section
and moving the contents read permissions block to the workflow’s top level,
outside workflow_call, so the reusable workflow uses only supported
workflow_call keys.

inputs:
node_version:
description: Node version
Expand Down
6 changes: 5 additions & 1 deletion .github/workflows/ci-python.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,5 @@
name: CI — Python
permissions:
contents: readname: CI — Python
Comment on lines +1 to +2

@coderabbitai coderabbitai Bot Jul 15, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🔴 Critical | ⚡ Quick win

Restore a valid workflow header and remove the duplicate permissions block.

contents: readname: CI — Python is malformed YAML and loses the workflow name. Keep one top-level block, for example:

-  contents: readname: CI — Python
+  contents: read
+name: CI — Python
...
-permissions:
-  contents: read

Also applies to: 17-18

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ci-python.yml around lines 1 - 2, Fix the top-level header
in the CI workflow by separating the workflow name from the permissions
declaration into valid YAML, preserving the intended `CI — Python` name and a
single `contents: read` permissions block. Remove the duplicate permissions
block referenced by the comment.


on:
push:
Expand All @@ -13,6 +14,9 @@ on:
- 'backend/**'
- 'requirements*.txt'

permissions:
contents: read

concurrency:
group: ci-python-${{ github.ref }}
cancel-in-progress: true
Expand Down
4 changes: 3 additions & 1 deletion .github/workflows/ci-security.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,7 @@
name: \uD83D\uDD12 Security Scan

permissions read
on:
read
on:
workflow_call:
inputs:
Expand Down
3 changes: 2 additions & 1 deletion .github/workflows/ci-unit.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,8 @@ name: \uD83E\uDDEA Unit Tests

on:
workflow_dispatch:

permissions:
contents: read
jobs:
python-unit:
name: Python Unit Tests
Expand Down
4 changes: 4 additions & 0 deletions .github/workflows/docker-build.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,9 @@
name: Docker Build & Test

permissions:
contents: read
on:
read
on:
push:
branches: [ main, develop ]
Expand Down
4 changes: 4 additions & 0 deletions .github/workflows/docker-push.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,9 @@
name: Docker Push to Registry

permissions:
contents: read
on:
read
on:
push:
branches: [ main ]
Expand Down
4 changes: 4 additions & 0 deletions .github/workflows/docker.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,9 @@
name: Docker Build & Verify

permissions:
contents: read
on:
read
Comment on lines +5 to +6

@coderabbitai coderabbitai Bot Jul 15, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🔴 Critical | ⚡ Quick win

Remove invalid on: read triggers and duplicate keys across workflows.

The read event is not a recognised GitHub Actions trigger. Adding these on: blocks also creates duplicate YAML keys, as the actual event triggers are already defined elsewhere in these files. This malformed syntax will cause the YAML parser to fail and prevent the workflows from running.

  • .github/workflows/docker.yml#L5-L6: Remove the invalid on: read block.
  • .github/workflows/docs-check.yml#L5-L6: Remove the invalid on: read block.
  • .github/workflows/docs-lint.yml#L5-L6: Remove the invalid on: read block.
  • .github/workflows/evo-harness.yml#L8-L9: Remove the invalid on: read block.
  • .github/workflows/health.yml#L5-L6: Remove the invalid on: read block.
  • .github/workflows/quality-gate.yml#L9-L10: Remove the invalid on: read block.
  • .github/workflows/secret-redaction-guard.yml#L9-L10: Remove the invalid on: read block.
  • .github/workflows/security-comprehensive.yml#L5-L8: Remove both invalid on: read blocks.
📍 Affects 8 files
  • .github/workflows/docker.yml#L5-L6 (this comment)
  • .github/workflows/docs-check.yml#L5-L6
  • .github/workflows/docs-lint.yml#L5-L6
  • .github/workflows/evo-harness.yml#L8-L9
  • .github/workflows/health.yml#L5-L6
  • .github/workflows/quality-gate.yml#L9-L10
  • .github/workflows/secret-redaction-guard.yml#L9-L10
  • .github/workflows/security-comprehensive.yml#L5-L8
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/docker.yml around lines 5 - 6, Remove the invalid
duplicate “on: read” blocks from .github/workflows/docker.yml (lines 5-6),
docs-check.yml (5-6), docs-lint.yml (5-6), evo-harness.yml (8-9), health.yml
(5-6), quality-gate.yml (9-10), and secret-redaction-guard.yml (9-10). In
.github/workflows/security-comprehensive.yml (5-8), remove both invalid blocks
while preserving each workflow’s existing valid event triggers.

on:
push:
branches: [ "main" ]
Expand Down
4 changes: 4 additions & 0 deletions .github/workflows/docs-check.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,9 @@
name: Docs Check

permissions:
contents: read
on:
read
on:
pull_request:
paths:
Expand Down
4 changes: 4 additions & 0 deletions .github/workflows/docs-lint.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,9 @@
name: Docs Lint

permissions:
contents: read
on:
read
on:
pull_request:
paths:
Expand Down
4 changes: 4 additions & 0 deletions .github/workflows/evo-harness.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,10 @@ name: Evo Harness — Long-Horizon Regression
# P2-1 — keeps HyperCode GREEN across multi-phase changes (separate from Trivy).
# CI-safe: parses docs/ROADMAP.md → milestone DAG → scores. No stack, no rollback.

permissions:
contents: read
on:
read
on:
push:
branches: [main]
Expand Down
4 changes: 4 additions & 0 deletions .github/workflows/health-check.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,9 @@
name: 💚 HyperCode Health Check

permissions:
contents: read
on:
read
Comment on lines +5 to +6

@coderabbitai coderabbitai Bot Jul 15, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🔴 Critical | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

for f in .github/workflows/health-check.yml .github/workflows/trivy-weekly.yml; do
  echo "== $f =="
  nl -ba "$f" | sed -n '1,80p'
  echo
done

Repository: welshDog/HyperCode-V2.4

Length of output: 242

🏁 Script executed:

#!/bin/bash
set -euo pipefail

for f in .github/workflows/health-check.yml .github/workflows/trivy-weekly.yml; do
  echo "== $f =="
  cat -n "$f" | sed -n '1,120p'
  echo
done

Repository: welshDog/HyperCode-V2.4

Length of output: 8806

🌐 Web query:

GitHub Actions workflow duplicate top-level keys YAML duplicate on key behaviour

💡 Result:

In GitHub Actions, the presence of duplicate top-level keys or duplicate keys within any mapping in a workflow YAML file is treated as a critical syntax error [1][2]. Unlike some standard YAML parsers—which may silently accept duplicates by either using the first occurrence or overwriting it with the last—GitHub Actions uses a strict parser that will reject the file entirely [1][2]. If your workflow contains duplicate keys, it will fail to load, and no jobs will be triggered [1][2]. You will typically encounter an error message indicating that a specific key is already defined [2]. Key aspects of this behavior include: 1. Case-insensitivity: For certain keys in GitHub Actions, the parser treats keys as case-insensitive [3][4]. Consequently, you cannot have duplicate keys even if the capitalization differs (e.g., matrix and MATRIX are treated as the same key) [3][4]. 2. Strict Parsing: Because GitHub Actions employs a strict parser, you cannot rely on local linting tools that use permissive YAML parsers (like standard Python PyYAML) to validate your workflow, as those tools might not flag the duplicates that GitHub will [2]. 3. Prevention: To avoid this issue, it is recommended to use specialized linting tools such as actionlint, which are specifically designed to catch GitHub Actions-compliant syntax errors, including duplicate keys, before you commit or push your code [3][4]. Alternatively, configuring a generic YAML linter like yamllint with the key-duplicates rule enabled is an effective way to detect these errors in your CI pipeline [5].

Citations:

Fix the workflow keys

on: read is a stray top-level key, and both workflows define on: twice; .github/workflows/trivy-weekly.yml also defines permissions: twice. That will prevent GitHub Actions from loading the workflows.

  • .github/workflows/health-check.yml: remove the stray on: read block and keep a single on: mapping.
  • .github/workflows/trivy-weekly.yml: remove the stray on: read block, drop the duplicate permissions: block, and keep a single on: mapping.
📍 Affects 2 files
  • .github/workflows/health-check.yml#L5-L6 (this comment)
  • .github/workflows/trivy-weekly.yml#L5-L6
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/health-check.yml around lines 5 - 6, Fix the workflow YAML
keys in .github/workflows/health-check.yml at lines 5-6 by removing the stray
“on: read” block and retaining one valid on: mapping. Apply the same removal in
.github/workflows/trivy-weekly.yml at lines 5-6, also remove its duplicate
permissions: block, and ensure each workflow contains exactly one on: mapping.

on:
push:
branches: [main]
Expand Down
4 changes: 4 additions & 0 deletions .github/workflows/health.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,9 @@
name: Health Checks

permissions:
contents: read
on:
read
on:
workflow_dispatch:

Expand Down
4 changes: 4 additions & 0 deletions .github/workflows/hyper-agents-ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,9 @@
name: Hyper Agents CI

permissions:
contents: read
on:
read
Comment on lines +3 to +6

@coderabbitai coderabbitai Bot Jul 15, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🔴 Critical | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail
files=(
  .github/workflows/hyper-agents-ci.yml
  .github/workflows/hyper-agents-gate2-e2e.yml
  .github/workflows/iac-scan.yml
  .github/workflows/lean-review.yml
  .github/workflows/no-legacy-paths.yml
  .github/workflows/playwright-dashboard.yml
  .github/workflows/promote-dashboards.yml
  .github/workflows/prune_audit.yml
)
for file in "${files[@]}"; do
  test "$(grep -cE '^on:$' "$file")" -eq 1
  ! grep -qE '^  read$' "$file"
done

Repository: welshDog/HyperCode-V2.4

Length of output: 161

🏁 Script executed:

#!/bin/bash
set -euo pipefail

files=(
  .github/workflows/hyper-agents-ci.yml
  .github/workflows/hyper-agents-gate2-e2e.yml
  .github/workflows/iac-scan.yml
  .github/workflows/lean-review.yml
  .github/workflows/no-legacy-paths.yml
  .github/workflows/playwright-dashboard.yml
  .github/workflows/promote-dashboards.yml
  .github/workflows/prune_audit.yml
)

for file in "${files[@]}"; do
  echo "===== $file ====="
  sed -n '1,30p' "$file" | cat -n
  echo
done

Repository: welshDog/HyperCode-V2.4

Length of output: 7017

Remove the stray on: read block from these workflows. read is not a GitHub Actions trigger, and the duplicate top-level on key can mask the real event mapping. Affects .github/workflows/hyper-agents-ci.yml, .github/workflows/hyper-agents-gate2-e2e.yml, .github/workflows/iac-scan.yml, .github/workflows/lean-review.yml, .github/workflows/no-legacy-paths.yml, .github/workflows/playwright-dashboard.yml, .github/workflows/promote-dashboards.yml, and .github/workflows/prune_audit.yml.

📍 Affects 8 files
  • .github/workflows/hyper-agents-ci.yml#L3-L6 (this comment)
  • .github/workflows/hyper-agents-gate2-e2e.yml#L3-L6
  • .github/workflows/iac-scan.yml#L3-L6
  • .github/workflows/lean-review.yml#L3-L6
  • .github/workflows/no-legacy-paths.yml#L3-L6
  • .github/workflows/playwright-dashboard.yml#L3-L6
  • .github/workflows/promote-dashboards.yml#L3-L6
  • .github/workflows/prune_audit.yml#L3-L6
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/hyper-agents-ci.yml around lines 3 - 6, Remove the stray
top-level “on: read” block from .github/workflows/hyper-agents-ci.yml (lines
3-6), .github/workflows/hyper-agents-gate2-e2e.yml (lines 3-6),
.github/workflows/iac-scan.yml (lines 3-6), .github/workflows/lean-review.yml
(lines 3-6), .github/workflows/no-legacy-paths.yml (lines 3-6),
.github/workflows/playwright-dashboard.yml (lines 3-6),
.github/workflows/promote-dashboards.yml (lines 3-6), and
.github/workflows/prune_audit.yml (lines 3-6), preserving each workflow’s valid
event mapping.</code>

on:
push:
branches:
Expand Down
4 changes: 4 additions & 0 deletions .github/workflows/hyper-agents-gate2-e2e.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,9 @@
name: Hyper Agents Gate 2 — E2E & Full Stack

permissions:
contents: read
on:
read
on:
pull_request:
branches:
Expand Down
4 changes: 4 additions & 0 deletions .github/workflows/iac-scan.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,9 @@
name: IaC & Dockerfile Scan

permissions:
contents: read
on:
read
on:
push:
branches: [main, master]
Expand Down
5 changes: 5 additions & 0 deletions .github/workflows/lean-review.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,9 @@
name: Lean Duplicate Review

permissions:
contents: read
on:
read
on:
push:
paths:
Expand Down
5 changes: 5 additions & 0 deletions .github/workflows/no-legacy-paths.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,9 @@
name: No Legacy Paths Guard

permissions:
contents: read
on:
read
on:
push:
branches:
Expand Down
4 changes: 4 additions & 0 deletions .github/workflows/performance.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,10 @@

name: Performance Testing

permissions:
contents: read
on:
read
Comment on lines +6 to +7

@coderabbitai coderabbitai Bot Jul 15, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🔴 Critical | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

files=(
  .github/workflows/performance.yml
  .github/workflows/sse-tests.yml
  .github/workflows/ci-security.yml
  .github/workflows/docker-build.yml
  .github/workflows/docker-push.yml
  .github/workflows/swarm-pipeline.yml
  .github/workflows/tests.yml
  .github/workflows/trivy-scan.yml
)

for f in "${files[@]}"; do
  echo "===== $f ====="
  nl -ba "$f" | sed -n '1,40p'
  echo
done

Repository: welshDog/HyperCode-V2.4

Length of output: 248

🏁 Script executed:

#!/bin/bash
set -euo pipefail
rg -n '^\s*on:\s*$|^\s*read\s*$' .github/workflows/*.yml

Repository: welshDog/HyperCode-V2.4

Length of output: 3878

Remove the stray read line from these workflow trigger blocks. It sits under on: and makes the workflow YAML invalid; if the intent was read-only access, move it under permissions: and leave the existing events unchanged.

  • .github/workflows/performance.yml
  • .github/workflows/sse-tests.yml
  • .github/workflows/ci-security.yml
  • .github/workflows/docker-build.yml
  • .github/workflows/docker-push.yml
  • .github/workflows/swarm-pipeline.yml
  • .github/workflows/tests.yml
  • .github/workflows/trivy-scan.yml
📍 Affects 8 files
  • .github/workflows/performance.yml#L6-L7 (this comment)
  • .github/workflows/sse-tests.yml#L5-L6
  • .github/workflows/ci-security.yml#L3-L4
  • .github/workflows/docker-build.yml#L5-L6
  • .github/workflows/docker-push.yml#L5-L6
  • .github/workflows/swarm-pipeline.yml#L5-L6
  • .github/workflows/tests.yml#L5-L6
  • .github/workflows/trivy-scan.yml#L5-L6
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/performance.yml around lines 6 - 7, Remove the stray read
entry from the on: trigger blocks in .github/workflows/performance.yml (lines
6-7), .github/workflows/sse-tests.yml (lines 5-6),
.github/workflows/ci-security.yml (lines 3-4),
.github/workflows/docker-build.yml (lines 5-6),
.github/workflows/docker-push.yml (lines 5-6),
.github/workflows/swarm-pipeline.yml (lines 5-6), .github/workflows/tests.yml
(lines 5-6), and .github/workflows/trivy-scan.yml (lines 5-6); preserve all
existing workflow events, and only add read under permissions: if read-only
access was intended.

on:
workflow_dispatch:

Expand Down
4 changes: 4 additions & 0 deletions .github/workflows/playwright-dashboard.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,9 @@
name: Playwright Dashboard E2E

permissions:
contents: read
on:
read
on:
workflow_dispatch:
push:
Expand Down
4 changes: 4 additions & 0 deletions .github/workflows/promote-dashboards.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,9 @@
name: Promote dashboards to Grafana Cloud

permissions:
contents: read
on:
read
on:
push:
branches: [main]
Expand Down
4 changes: 4 additions & 0 deletions .github/workflows/prune_audit.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,9 @@
name: Prune Celery Task Audit

permissions:
contents: read
on:
read
on:
schedule:
- cron: '0 3 * * *'
Expand Down
4 changes: 4 additions & 0 deletions .github/workflows/quality-gate.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,10 @@ name: Quality Gate — Master Orchestrator
# It calls the specialist workflows and enforces thresholds from
# quality-gate-thresholds.yml.

permissions:
contents: read
on:
read
on:
push:
branches: [main, master]
Expand Down
5 changes: 4 additions & 1 deletion .github/workflows/secret-redaction-guard.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,10 @@ on:
push:
branches: [ "main", "production", "feature/**", "fix/**" ]
workflow_dispatch:

permissions:
contents: read
on:
read
jobs:
guard:
runs-on: ubuntu-latest
Expand Down
6 changes: 6 additions & 0 deletions .github/workflows/security-comprehensive.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,11 @@
name: Security — Comprehensive Scan

permissions:
contents: read
on:
read
on:
read
on:
push:
branches: [main] # ← main only, never feature branches
Expand Down
4 changes: 4 additions & 0 deletions .github/workflows/sse-tests.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,9 @@
name: Fast SSE Tests

permissions:
contents: read
on:
read
on:
push:
paths:
Expand Down
4 changes: 4 additions & 0 deletions .github/workflows/swarm-pipeline.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,9 @@
name: Swarm Pipeline

permissions:
contents: read
on:
read
on:
workflow_dispatch:

Expand Down
4 changes: 4 additions & 0 deletions .github/workflows/tests.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,9 @@
name: Tests & Quality

permissions:
contents: read
on:
read
on:
workflow_call:
schedule:
Expand Down
4 changes: 4 additions & 0 deletions .github/workflows/trivy-scan.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,9 @@
name: Trivy Security Scan

permissions:
contents: read
Comment on lines +3 to +4

@coderabbitai coderabbitai Bot Jul 15, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

sed -n '1,220p' .github/workflows/trivy-scan.yml
printf '\n---\n'
rg -n "upload-sarif|security-events|permissions:" .github/workflows -S

Repository: welshDog/HyperCode-V2.4

Length of output: 4656

🌐 Web query:

github codeql action upload-sarif security-events write permission

💡 Result:

To use the GitHub CodeQL upload-sarif action, your workflow job must be granted security-events: write permission [1][2]. This permission allows the action to upload SARIF results to GitHub Code Scanning [3][4]. Key considerations include: 1. Permission Scope: When you explicitly define a permissions block in your workflow or at the job level, GitHub overrides the default permissions and grants only those you specify [5]. If you do not include security-events: write in your explicit block, the action will fail with a "Resource not accessible" error [6][7]. 2. Implementation: You can grant this permission at the workflow level or the specific job level where the action runs [5]. Example configuration: permissions: contents: read security-events: write 3. Token usage: The upload-sarif action requires the built-in GITHUB_TOKEN to function correctly for uploading to Code Scanning [1][8]. While the action includes a token input, it is generally intended for the built-in token, and using custom personal access tokens (PATs) for this specific action is often not supported or necessary [8]. 4. Best Practices: If your repository is private, ensure you also grant contents: read permissions so the action can access the repository source code [2]. Following the principle of least privilege, explicitly defining only the required permissions (e.g., contents: read and security-events: write) is recommended to secure your workflow [5][4].

Citations:

Add security-events: write to .github/workflows/trivy-scan.yml. github/codeql-action/upload-sarif@v4 needs that permission; with only contents: read, the SARIF upload will fail.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/trivy-scan.yml around lines 3 - 4, Update the workflow
permissions block in trivy-scan.yml to retain contents: read and add
security-events: write, ensuring github/codeql-action/upload-sarif@v4 can upload
SARIF results.

on:
read
on:
push:
branches: [main] # ← main only
Expand Down
4 changes: 4 additions & 0 deletions .github/workflows/trivy-weekly.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,9 @@
name: 🔒 Weekly Fleet Security Scan

permissions:
contents: read
on:
read
on:
schedule:
- cron: '0 6 * * 1' # Every Monday 06:00 UTC
Expand Down
1 change: 1 addition & 0 deletions HyperCode-V2.4
Open in desktop
Submodule HyperCode-V2.4 added at 2fbbcb
Loading
Loading