fix(ci): workflow permissions cleanup - #329
Merged
Merged
Conversation
Add least-privilege contents: read permission to all GitHub Actions workflows, fix malformed YAML syntax across CI configuration files, correct duplicate workflow name lines, and repair broken trigger declarations.
📝 WalkthroughWalkthroughThe pull request updates Dependabot and numerous GitHub Actions headers with read-only contents permissions and related YAML configuration. It also changes the HyperCode submodule reference and records repository-wide line-ending conversions in status output. ChangesActions configuration
Repository metadata
Estimated code review effort: 3 (Moderate) | ~20 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 8
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
tatus --short (1)
1-869: 📐 Maintainability & Code Quality | 🟠 Major | ⚡ Quick winRemove accidentally committed terminal output.
It appears this file was created accidentally by redirecting terminal output (likely from a
gitcommand) into a file namedtatus --short. Please remove this file from the repository to maintain a clean codebase.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@tatus` --short around lines 1 - 869, Remove the accidentally committed file named “tatus --short” from the repository, including its tracked contents; no other files or behavior need to change.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/dependabot.yml:
- Around line 7-21: Remove the entire GitHub Actions workflow block from the
Dependabot configuration, including permissions, both on entries, concurrency,
and jobs. Retain only valid Dependabot configuration keys and entries.
In @.github/workflows/ci-cd.yml:
- Around line 8-9: Add security-events: write to the security-scan job
permissions in .github/workflows/ci-cd.yml, while retaining contents: read so
github/codeql-action/upload-sarif can complete. Apply the equivalent permission
update in .github/workflows/security-comprehensive.yml at lines 3-4.
In @.github/workflows/ci-js.yml:
- Around line 5-8: Move the permissions declaration out of the workflow_call
inputs block in ci-js.yml, placing contents: read at the workflow top level or
on the invoking job in quality-gate.yml. Keep the existing read-only contents
permission unchanged.
In @.github/workflows/ci-python.yml:
- Around line 1-2: Repair the workflow header so `name:` is a separate top-level
key rather than concatenated with `permissions:`, and remove the duplicate
top-level `permissions` declaration later in the workflow. Preserve a single
valid workflow name and one permissions block containing the intended settings.
In @.github/workflows/docker.yml:
- Around line 3-6: Remove the stray “on: read” trigger from
.github/workflows/docker.yml (lines 3-6), .github/workflows/docs-check.yml
(lines 3-6), .github/workflows/docs-lint.yml (lines 3-6),
.github/workflows/evo-harness.yml (lines 6-9),
.github/workflows/health-check.yml (lines 3-6), .github/workflows/trivy-scan.yml
(lines 3-6), and .github/workflows/trivy-weekly.yml (lines 3-6), preserving each
workflow’s valid triggers and permissions.
In @.github/workflows/health.yml:
- Around line 5-6: Remove the invalid on: read trigger from
.github/workflows/health.yml lines 5-6, .github/workflows/hyper-agents-ci.yml
lines 5-6, .github/workflows/hyper-agents-gate2-e2e.yml lines 5-6,
.github/workflows/iac-scan.yml lines 5-6, and .github/workflows/lean-review.yml
lines 5-6, leaving each workflow’s valid triggers and permissions unchanged.
In @.github/workflows/no-legacy-paths.yml:
- Around line 5-6: Remove the stray “on: read” entries and retain each
workflow’s following trigger map. Apply this change in
.github/workflows/no-legacy-paths.yml (lines 5-6),
.github/workflows/performance.yml (lines 6-7),
.github/workflows/playwright-dashboard.yml (lines 5-6),
.github/workflows/promote-dashboards.yml (lines 5-6),
.github/workflows/prune_audit.yml (lines 5-6), and
.github/workflows/quality-gate.yml (lines 9-10).
In @.github/workflows/security-comprehensive.yml:
- Around line 5-8: Remove the stray on: read entries from
.github/workflows/security-comprehensive.yml lines 5-8,
.github/workflows/secret-redaction-guard.yml lines 9-10, and
.github/workflows/sse-tests.yml lines 5-6; preserve each workflow’s existing
valid trigger block.
---
Outside diff comments:
In `@tatus` --short:
- Around line 1-869: Remove the accidentally committed file named “tatus
--short” from the repository, including its tracked contents; no other files or
behavior need to change.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: c73d2d14-6c04-40c7-bfae-082e832b8db8
📒 Files selected for processing (35)
.github/dependabot.yml.github/workflows/accessibility.yml.github/workflows/ci-cd.yml.github/workflows/ci-integration.yml.github/workflows/ci-js.yml.github/workflows/ci-python.yml.github/workflows/ci-security.yml.github/workflows/ci-unit.yml.github/workflows/docker-build.yml.github/workflows/docker-push.yml.github/workflows/docker.yml.github/workflows/docs-check.yml.github/workflows/docs-lint.yml.github/workflows/evo-harness.yml.github/workflows/health-check.yml.github/workflows/health.yml.github/workflows/hyper-agents-ci.yml.github/workflows/hyper-agents-gate2-e2e.yml.github/workflows/iac-scan.yml.github/workflows/lean-review.yml.github/workflows/no-legacy-paths.yml.github/workflows/performance.yml.github/workflows/playwright-dashboard.yml.github/workflows/promote-dashboards.yml.github/workflows/prune_audit.yml.github/workflows/quality-gate.yml.github/workflows/secret-redaction-guard.yml.github/workflows/security-comprehensive.yml.github/workflows/sse-tests.yml.github/workflows/swarm-pipeline.yml.github/workflows/tests.yml.github/workflows/trivy-scan.yml.github/workflows/trivy-weekly.ymlHyperCode-V2.4tatus --short
Comment on lines
+7
to
+21
| permissions: | ||
| contents: read | ||
| on: | ||
| read | ||
| on: | ||
| push: | ||
| branches: [main, master] | ||
| pull_request: | ||
| branches: [main, master] | ||
| workflow_dispatch: | ||
| concurrency: | ||
| group: ${{ github.workflow }}-${{ github.ref }} | ||
| cancel-in-progress: true | ||
| jobs: | ||
| lint: |
There was a problem hiding this comment.
🎯 Functional Correctness | 🔴 Critical | ⚡ Quick win
Remove GitHub Actions syntax from the Dependabot configuration.
The .github/dependabot.yml file uses a distinct schema and does not support GitHub Actions workflow keys such as permissions, on, concurrency, and jobs. Adding these will cause Dependabot to fail schema validation, preventing it from functioning. Furthermore, this block contains an invalid on: read trigger and duplicate on keys.
Please remove this entire block from the configuration.
🐛 Proposed fix to remove invalid configuration
- permissions:
- contents: read
- on:
- read
- on:
- push:
- branches: [main, master]
- pull_request:
- branches: [main, master]
- workflow_dispatch:
- concurrency:
- group: ${{ github.workflow }}-${{ github.ref }}
- cancel-in-progress: true
- jobs:
- lint:📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| permissions: | |
| contents: read | |
| on: | |
| read | |
| on: | |
| push: | |
| branches: [main, master] | |
| pull_request: | |
| branches: [main, master] | |
| workflow_dispatch: | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| lint: |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/dependabot.yml around lines 7 - 21, Remove the entire GitHub Actions
workflow block from the Dependabot configuration, including permissions, both on
entries, concurrency, and jobs. Retain only valid Dependabot configuration keys
and entries.
Comment on lines
+8
to
+9
| permissions: | ||
| contents: read |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '\n## ci-cd.yml\n'
nl -ba .github/workflows/ci-cd.yml | sed -n '1,220p'
printf '\n## security-comprehensive.yml\n'
nl -ba .github/workflows/security-comprehensive.yml | sed -n '1,260p'
printf '\n## SARIF upload references\n'
rg -n "upload-sarif|codeql-action/upload-sarif|security-events: write|permissions:" .github/workflows -SRepository: welshDog/HyperCode-V2.4
Length of output: 215
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '\n## ci-cd.yml\n'
sed -n '1,240p' .github/workflows/ci-cd.yml | cat -n
printf '\n## security-comprehensive.yml\n'
sed -n '1,320p' .github/workflows/security-comprehensive.yml | cat -n
printf '\n## SARIF upload references\n'
rg -n "upload-sarif|codeql-action/upload-sarif|security-events: write|permissions:" .github/workflows -SRepository: welshDog/HyperCode-V2.4
Length of output: 16438
Add security-events: write to security-scan
github/codeql-action/upload-sarif in .github/workflows/ci-cd.yml needs that permission; contents: read at workflow scope removes it and the scan job will fail before the downstream deploys.
📍 Affects 2 files
.github/workflows/ci-cd.yml#L8-L9(this comment).github/workflows/security-comprehensive.yml#L3-L4
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/ci-cd.yml around lines 8 - 9, Add security-events: write
to the security-scan job permissions in .github/workflows/ci-cd.yml, while
retaining contents: read so github/codeql-action/upload-sarif can complete.
Apply the equivalent permission update in
.github/workflows/security-comprehensive.yml at lines 3-4.
Comment on lines
+5
to
+8
| inputs: | ||
|
|
||
| permissions: | ||
| contents: read |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
printf 'ci-js.yml:\n'; sed -n '1,120p' .github/workflows/ci-js.yml; printf '\nquality-gate.yml:\n'; sed -n '1,200p' .github/workflows/quality-gate.ymlRepository: welshDog/HyperCode-V2.4
Length of output: 9678
Move permissions out of on.workflow_call. Declare it at the workflow top level, or on the caller job in .github/workflows/quality-gate.yml; permissions is not a supported field inside workflow_call.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/ci-js.yml around lines 5 - 8, Move the permissions
declaration out of the workflow_call inputs block in ci-js.yml, placing
contents: read at the workflow top level or on the invoking job in
quality-gate.yml. Keep the existing read-only contents permission unchanged.
Comment on lines
+1
to
+2
| permissions: | ||
| contents: readname: CI — Python |
There was a problem hiding this comment.
🎯 Functional Correctness | 🔴 Critical | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
sed -n '1,40p' .github/workflows/ci-python.yml | cat -nRepository: welshDog/HyperCode-V2.4
Length of output: 1185
🏁 Script executed:
ruby - <<'RUBY'
require 'yaml'
path = '.github/workflows/ci-python.yml'
text = File.read(path)
begin
data = YAML.safe_load(text, aliases: true)
puts "Parsed as: #{data.class}"
p data
rescue => e
warn "#{e.class}: #{e.message}"
end
RUBYRepository: welshDog/HyperCode-V2.4
Length of output: 261
Repair the workflow header
name is concatenated onto the permissions value on line 2, which breaks the YAML, and there is a second top-level permissions block later in the file. Keep a single valid name: and one top-level permissions: block.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/ci-python.yml around lines 1 - 2, Repair the workflow
header so `name:` is a separate top-level key rather than concatenated with
`permissions:`, and remove the duplicate top-level `permissions` declaration
later in the workflow. Preserve a single valid workflow name and one permissions
block containing the intended settings.
Comment on lines
+3
to
+6
| permissions: | ||
| contents: read | ||
| on: | ||
| read |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
files=(
.github/workflows/docker.yml
.github/workflows/docs-check.yml
.github/workflows/docs-lint.yml
.github/workflows/evo-harness.yml
.github/workflows/health-check.yml
.github/workflows/trivy-scan.yml
.github/workflows/trivy-weekly.yml
)
for f in "${files[@]}"; do
echo "===== $f ====="
nl -ba "$f" | sed -n '1,40p'
echo
doneRepository: welshDog/HyperCode-V2.4
Length of output: 243
🏁 Script executed:
#!/bin/bash
set -euo pipefail
python3 - <<'PY'
from pathlib import Path
files = [
Path('.github/workflows/docker.yml'),
Path('.github/workflows/docs-check.yml'),
Path('.github/workflows/docs-lint.yml'),
Path('.github/workflows/evo-harness.yml'),
Path('.github/workflows/health-check.yml'),
Path('.github/workflows/trivy-scan.yml'),
Path('.github/workflows/trivy-weekly.yml'),
]
for p in files:
print(f"===== {p} =====")
text = p.read_text()
for i, line in enumerate(text.splitlines(), 1):
if i <= 30:
print(f"{i:>4}: {line}")
print()
PYRepository: welshDog/HyperCode-V2.4
Length of output: 5771
🏁 Script executed:
#!/bin/bash
set -euo pipefail
python3 - <<'PY'
import re
from pathlib import Path
files = [
Path('.github/workflows/docker.yml'),
Path('.github/workflows/docs-check.yml'),
Path('.github/workflows/docs-lint.yml'),
Path('.github/workflows/evo-harness.yml'),
Path('.github/workflows/health-check.yml'),
Path('.github/workflows/trivy-scan.yml'),
Path('.github/workflows/trivy-weekly.yml'),
]
for p in files:
txt = p.read_text()
m = re.search(r'^\s*on:\s*read\s*$', txt, flags=re.M)
print(f"{p}: {'HAS on: read' if m else 'NO on: read'}")
PYRepository: welshDog/HyperCode-V2.4
Length of output: 490
🏁 Script executed:
#!/bin/bash
set -euo pipefail
python3 - <<'PY'
from pathlib import Path
files = [
Path('.github/workflows/docker.yml'),
Path('.github/workflows/docs-check.yml'),
Path('.github/workflows/docs-lint.yml'),
Path('.github/workflows/evo-harness.yml'),
Path('.github/workflows/health-check.yml'),
Path('.github/workflows/trivy-scan.yml'),
Path('.github/workflows/trivy-weekly.yml'),
]
for p in files:
print(f"===== {p} =====")
for i, line in enumerate(p.read_text().splitlines(), 1):
if i <= 20:
print(f"{i:>4}: {line}")
print()
PYRepository: welshDog/HyperCode-V2.4
Length of output: 3618
🏁 Script executed:
#!/bin/bash
set -euo pipefail
python3 - <<'PY'
import re
from pathlib import Path
files = [
Path('.github/workflows/docker.yml'),
Path('.github/workflows/docs-check.yml'),
Path('.github/workflows/docs-lint.yml'),
Path('.github/workflows/evo-harness.yml'),
Path('.github/workflows/health-check.yml'),
Path('.github/workflows/trivy-scan.yml'),
Path('.github/workflows/trivy-weekly.yml'),
]
for p in files:
txt = p.read_text()
has = bool(re.search(r'^\s*on:\s*read\s*$', txt, flags=re.M))
print(f"{p}: {'HAS on: read' if has else 'NO on: read'}")
PYRepository: welshDog/HyperCode-V2.4
Length of output: 490
Remove the stray on: read trigger from these workflows
read is not a workflow event, and the extra on: block leaves each file with a malformed trigger section. Remove it from:
.github/workflows/docker.yml.github/workflows/docs-check.yml.github/workflows/docs-lint.yml.github/workflows/evo-harness.yml.github/workflows/health-check.yml.github/workflows/trivy-scan.yml.github/workflows/trivy-weekly.yml
📍 Affects 7 files
.github/workflows/docker.yml#L3-L6(this comment).github/workflows/docs-check.yml#L3-L6.github/workflows/docs-lint.yml#L3-L6.github/workflows/evo-harness.yml#L6-L9.github/workflows/health-check.yml#L3-L6.github/workflows/trivy-scan.yml#L3-L6.github/workflows/trivy-weekly.yml#L3-L6
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/docker.yml around lines 3 - 6, Remove the stray “on: read”
trigger from .github/workflows/docker.yml (lines 3-6),
.github/workflows/docs-check.yml (lines 3-6), .github/workflows/docs-lint.yml
(lines 3-6), .github/workflows/evo-harness.yml (lines 6-9),
.github/workflows/health-check.yml (lines 3-6), .github/workflows/trivy-scan.yml
(lines 3-6), and .github/workflows/trivy-weekly.yml (lines 3-6), preserving each
workflow’s valid triggers and permissions.
Comment on lines
+5
to
+6
| on: | ||
| read |
There was a problem hiding this comment.
🎯 Functional Correctness | 🔴 Critical | ⚡ Quick win
Remove invalid on: read event trigger.
The read value is not a recognised GitHub Actions event trigger. This appears to be a copy-paste error from the permissions block and will break the workflow due to an invalid trigger schema, likely resulting in a duplicate on key parsing error.
.github/workflows/health.yml#L5-L6: remove theon: readlines..github/workflows/hyper-agents-ci.yml#L5-L6: remove theon: readlines..github/workflows/hyper-agents-gate2-e2e.yml#L5-L6: remove theon: readlines..github/workflows/iac-scan.yml#L5-L6: remove theon: readlines..github/workflows/lean-review.yml#L5-L6: remove theon: readlines.
📍 Affects 5 files
.github/workflows/health.yml#L5-L6(this comment).github/workflows/hyper-agents-ci.yml#L5-L6.github/workflows/hyper-agents-gate2-e2e.yml#L5-L6.github/workflows/iac-scan.yml#L5-L6.github/workflows/lean-review.yml#L5-L6
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/health.yml around lines 5 - 6, Remove the invalid on: read
trigger from .github/workflows/health.yml lines 5-6,
.github/workflows/hyper-agents-ci.yml lines 5-6,
.github/workflows/hyper-agents-gate2-e2e.yml lines 5-6,
.github/workflows/iac-scan.yml lines 5-6, and .github/workflows/lean-review.yml
lines 5-6, leaving each workflow’s valid triggers and permissions unchanged.
Comment on lines
+5
to
+6
| on: | ||
| read |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
for f in \
.github/workflows/no-legacy-paths.yml \
.github/workflows/performance.yml \
.github/workflows/playwright-dashboard.yml \
.github/workflows/promote-dashboards.yml \
.github/workflows/prune_audit.yml \
.github/workflows/quality-gate.yml
do
echo "===== $f ====="
nl -ba "$f" | sed -n '1,40p'
echo
doneRepository: welshDog/HyperCode-V2.4
Length of output: 252
🏁 Script executed:
#!/bin/bash
set -euo pipefail
python3 - <<'PY'
from pathlib import Path
files = [
".github/workflows/no-legacy-paths.yml",
".github/workflows/performance.yml",
".github/workflows/playwright-dashboard.yml",
".github/workflows/promote-dashboards.yml",
".github/workflows/prune_audit.yml",
".github/workflows/quality-gate.yml",
]
for file in files:
print(f"===== {file} =====")
text = Path(file).read_text()
for i, line in enumerate(text.splitlines(), 1):
if 1 <= i <= 30:
print(f"{i:4d}: {line}")
print()
PYRepository: welshDog/HyperCode-V2.4
Length of output: 5357
🏁 Script executed:
#!/bin/bash
set -euo pipefail
nl -ba .github/workflows/no-legacy-paths.yml | sed -n '1,20p'Repository: welshDog/HyperCode-V2.4
Length of output: 201
🏁 Script executed:
python3 - <<'PY'
from pathlib import Path
import sys
try:
import yaml
except Exception as e:
print(f"PyYAML unavailable: {e}")
sys.exit(0)
files = [
".github/workflows/no-legacy-paths.yml",
".github/workflows/performance.yml",
".github/workflows/playwright-dashboard.yml",
".github/workflows/promote-dashboards.yml",
".github/workflows/prune_audit.yml",
".github/workflows/quality-gate.yml",
]
for file in files:
text = Path(file).read_text()
print(f"===== {file} =====")
try:
data = yaml.safe_load(text)
top = list(data.keys()) if isinstance(data, dict) else type(data).__name__
print("loaded:", top)
print("on:", data.get("on") if isinstance(data, dict) else None)
print("permissions:", data.get("permissions") if isinstance(data, dict) else None)
except Exception as e:
print("parse error:", type(e).__name__, e)
PYRepository: welshDog/HyperCode-V2.4
Length of output: 1072
🏁 Script executed:
python3 - <<'PY'
from pathlib import Path
import yaml
files = [
".github/workflows/no-legacy-paths.yml",
".github/workflows/performance.yml",
".github/workflows/playwright-dashboard.yml",
".github/workflows/promote-dashboards.yml",
".github/workflows/prune_audit.yml",
".github/workflows/quality-gate.yml",
]
def dump(node, indent=0):
pad = " " * indent
if isinstance(node, yaml.ScalarNode):
print(f"{pad}Scalar(tag={node.tag!r}, value={node.value!r})")
elif isinstance(node, yaml.SequenceNode):
print(f"{pad}Sequence(tag={node.tag!r})")
for item in node.value:
dump(item, indent + 1)
elif isinstance(node, yaml.MappingNode):
print(f"{pad}Mapping(tag={node.tag!r})")
for k, v in node.value:
print(f"{pad} Key:")
dump(k, indent + 2)
print(f"{pad} Value:")
dump(v, indent + 2)
else:
print(f"{pad}{type(node).__name__}")
for file in files:
print(f"===== {file} =====")
root = yaml.compose(Path(file).read_text())
dump(root)
print()
PYRepository: welshDog/HyperCode-V2.4
Length of output: 48294
Remove the stray on: read entries
Each workflow has a duplicate on: key; delete the read scalar and keep the trigger map below it:
.github/workflows/no-legacy-paths.yml.github/workflows/performance.yml.github/workflows/playwright-dashboard.yml.github/workflows/promote-dashboards.yml.github/workflows/prune_audit.yml.github/workflows/quality-gate.yml
📍 Affects 6 files
.github/workflows/no-legacy-paths.yml#L5-L6(this comment).github/workflows/performance.yml#L6-L7.github/workflows/playwright-dashboard.yml#L5-L6.github/workflows/promote-dashboards.yml#L5-L6.github/workflows/prune_audit.yml#L5-L6.github/workflows/quality-gate.yml#L9-L10
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/no-legacy-paths.yml around lines 5 - 6, Remove the stray
“on: read” entries and retain each workflow’s following trigger map. Apply this
change in .github/workflows/no-legacy-paths.yml (lines 5-6),
.github/workflows/performance.yml (lines 6-7),
.github/workflows/playwright-dashboard.yml (lines 5-6),
.github/workflows/promote-dashboards.yml (lines 5-6),
.github/workflows/prune_audit.yml (lines 5-6), and
.github/workflows/quality-gate.yml (lines 9-10).
Comment on lines
+5
to
+8
| on: | ||
| read | ||
| on: | ||
| read |
There was a problem hiding this comment.
🎯 Functional Correctness | 🔴 Critical | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '\n## security-comprehensive.yml\n'
cat -n .github/workflows/security-comprehensive.yml | sed -n '1,120p'
printf '\n## secret-redaction-guard.yml\n'
cat -n .github/workflows/secret-redaction-guard.yml | sed -n '1,120p'
printf '\n## sse-tests.yml\n'
cat -n .github/workflows/sse-tests.yml | sed -n '1,120p'
printf '\n## ci-cd.yml\n'
cat -n .github/workflows/ci-cd.yml | sed -n '1,160p'Repository: welshDog/HyperCode-V2.4
Length of output: 11684
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '\n## security-comprehensive.yml outline\n'
ast-grep outline .github/workflows/security-comprehensive.yml || true
printf '\n## secret-redaction-guard.yml outline\n'
ast-grep outline .github/workflows/secret-redaction-guard.yml || true
printf '\n## sse-tests.yml outline\n'
ast-grep outline .github/workflows/sse-tests.yml || true
printf '\n## ci-cd.yml outline\n'
ast-grep outline .github/workflows/ci-cd.yml || trueRepository: welshDog/HyperCode-V2.4
Length of output: 493
🏁 Script executed:
#!/bin/bash
set -euo pipefail
rg -n "on:\s*read|security-events:\s*write|sarif|permissions:" .github/workflows/security-comprehensive.yml .github/workflows/secret-redaction-guard.yml .github/workflows/sse-tests.yml .github/workflows/ci-cd.ymlRepository: welshDog/HyperCode-V2.4
Length of output: 2041
🏁 Script executed:
#!/bin/bash
set -euo pipefail
python3 - <<'PY'
from pathlib import Path
import sys
try:
import yaml
except Exception as e:
print(f"PyYAML unavailable: {e}")
sys.exit(0)
files = [
".github/workflows/security-comprehensive.yml",
".github/workflows/secret-redaction-guard.yml",
".github/workflows/sse-tests.yml",
]
for path in files:
text = Path(path).read_text()
print(f"\n## {path}")
try:
data = yaml.safe_load(text)
print("top-level keys:", list(data.keys()) if isinstance(data, dict) else type(data))
on_value = data.get("on") if isinstance(data, dict) else None
print("parsed on:", on_value)
except Exception as e:
print("parse error:", type(e).__name__, e)
PYRepository: welshDog/HyperCode-V2.4
Length of output: 527
Remove the stray on: read entries. read is not a valid workflow event, and the extra on: key in .github/workflows/security-comprehensive.yml leaves the trigger block malformed.
.github/workflows/security-comprehensive.yml#L5-L8: remove both addedon: readlines and keep the existing trigger block..github/workflows/secret-redaction-guard.yml#L9-L10: remove the addedon: read..github/workflows/sse-tests.yml#L5-L6: remove the addedon: read.
📍 Affects 3 files
.github/workflows/security-comprehensive.yml#L5-L8(this comment).github/workflows/secret-redaction-guard.yml#L9-L10.github/workflows/sse-tests.yml#L5-L6
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/security-comprehensive.yml around lines 5 - 8, Remove the
stray on: read entries from .github/workflows/security-comprehensive.yml lines
5-8, .github/workflows/secret-redaction-guard.yml lines 9-10, and
.github/workflows/sse-tests.yml lines 5-6; preserve each workflow’s existing
valid trigger block.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add contents: read to safe read-only workflows
Summary by CodeRabbit
Security
Configuration
Maintenance