Skip to content

fix(ci): workflow permissions cleanup #329

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
welshDog merged 1 commit into from
Jul 15, 2026
Merged

fix(ci): workflow permissions cleanup #329

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 15 additions & 1 deletion .github/dependabot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,21 @@
version: 2

updates:

permissions:
contents: read
on:
read
on:
push:
branches: [main, master]
pull_request:
branches: [main, master]
workflow_dispatch:
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
jobs:
lint:
Comment on lines +7 to +21

@coderabbitai coderabbitai Bot Jul 15, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🔴 Critical | ⚡ Quick win

Remove GitHub Actions syntax from the Dependabot configuration.

The .github/dependabot.yml file uses a distinct schema and does not support GitHub Actions workflow keys such as permissions, on, concurrency, and jobs. Adding these will cause Dependabot to fail schema validation, preventing it from functioning. Furthermore, this block contains an invalid on: read trigger and duplicate on keys.

Please remove this entire block from the configuration.

🐛 Proposed fix to remove invalid configuration 
-  permissions:
-    contents: read
-  on:
-    read
-  on:
-    push:
-      branches: [main, master]
-    pull_request:
-      branches: [main, master]
-    workflow_dispatch:
-  concurrency:
-    group: ${{ github.workflow }}-${{ github.ref }}
-    cancel-in-progress: true
-  jobs:
-    lint:
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
permissions:
contents: read
on:
read
on:
push:
branches: [main, master]
pull_request:
branches: [main, master]
workflow_dispatch:
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
jobs:
lint:
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/dependabot.yml around lines 7 - 21, Remove the entire GitHub Actions
workflow block from the Dependabot configuration, including permissions, both on
entries, concurrency, and jobs. Retain only valid Dependabot configuration keys
and entries.

# ── Python (pip) ──────────────────────────────────────────
- package-ecosystem: "pip"
directory: "/"
Expand Down
3 changes: 2 additions & 1 deletion .github/workflows/accessibility.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,8 @@ on:
schedule:
- cron: "0 2 * * *"
workflow_dispatch:

permissions:
contents: read
jobs:
a11y-dashboard:
runs-on: ubuntu-latest
Expand Down
3 changes: 2 additions & 1 deletion .github/workflows/ci-cd.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,8 @@ on:
branches: [main]
pull_request:
branches: [main]

permissions:
contents: read
Comment on lines +8 to +9

@coderabbitai coderabbitai Bot Jul 15, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '\n## ci-cd.yml\n'
nl -ba .github/workflows/ci-cd.yml | sed -n '1,220p'

printf '\n## security-comprehensive.yml\n'
nl -ba .github/workflows/security-comprehensive.yml | sed -n '1,260p'

printf '\n## SARIF upload references\n'
rg -n "upload-sarif|codeql-action/upload-sarif|security-events: write|permissions:" .github/workflows -S

Repository: welshDog/HyperCode-V2.4

Length of output: 215

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '\n## ci-cd.yml\n'
sed -n '1,240p' .github/workflows/ci-cd.yml | cat -n

printf '\n## security-comprehensive.yml\n'
sed -n '1,320p' .github/workflows/security-comprehensive.yml | cat -n

printf '\n## SARIF upload references\n'
rg -n "upload-sarif|codeql-action/upload-sarif|security-events: write|permissions:" .github/workflows -S

Repository: welshDog/HyperCode-V2.4

Length of output: 16438

Add security-events: write to security-scan
github/codeql-action/upload-sarif in .github/workflows/ci-cd.yml needs that permission; contents: read at workflow scope removes it and the scan job will fail before the downstream deploys.

📍 Affects 2 files
  • .github/workflows/ci-cd.yml#L8-L9 (this comment)
  • .github/workflows/security-comprehensive.yml#L3-L4
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ci-cd.yml around lines 8 - 9, Add security-events: write
to the security-scan job permissions in .github/workflows/ci-cd.yml, while
retaining contents: read so github/codeql-action/upload-sarif can complete.
Apply the equivalent permission update in
.github/workflows/security-comprehensive.yml at lines 3-4.

concurrency:
group: ci-cd-${{ github.ref }}
cancel-in-progress: true
Expand Down
3 changes: 2 additions & 1 deletion .github/workflows/ci-integration.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,8 @@ name: \uD83D\uDD17 Integration Tests

on:
workflow_dispatch:

permissions:
contents: read
jobs:
integration:
name: Integration Tests
Expand Down
4 changes: 4 additions & 0 deletions .github/workflows/ci-js.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,10 @@ name: JS CI

on:
workflow_call:
inputs:

permissions:
contents: read
Comment on lines +5 to +8

@coderabbitai coderabbitai Bot Jul 15, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

printf 'ci-js.yml:\n'; sed -n '1,120p' .github/workflows/ci-js.yml; printf '\nquality-gate.yml:\n'; sed -n '1,200p' .github/workflows/quality-gate.yml

Repository: welshDog/HyperCode-V2.4

Length of output: 9678

Move permissions out of on.workflow_call. Declare it at the workflow top level, or on the caller job in .github/workflows/quality-gate.yml; permissions is not a supported field inside workflow_call.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ci-js.yml around lines 5 - 8, Move the permissions
declaration out of the workflow_call inputs block in ci-js.yml, placing
contents: read at the workflow top level or on the invoking job in
quality-gate.yml. Keep the existing read-only contents permission unchanged.

inputs:
node_version:
description: Node version
Expand Down
6 changes: 5 additions & 1 deletion .github/workflows/ci-python.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,5 @@
name: CI — Python
permissions:
contents: readname: CI — Python
Comment on lines +1 to +2

@coderabbitai coderabbitai Bot Jul 15, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🔴 Critical | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

sed -n '1,40p' .github/workflows/ci-python.yml | cat -n

Repository: welshDog/HyperCode-V2.4

Length of output: 1185

🏁 Script executed:

ruby - <<'RUBY'
require 'yaml'

path = '.github/workflows/ci-python.yml'
text = File.read(path)

begin
  data = YAML.safe_load(text, aliases: true)
  puts "Parsed as: #{data.class}"
  p data
rescue => e
  warn "#{e.class}: #{e.message}"
end
RUBY

Repository: welshDog/HyperCode-V2.4

Length of output: 261

Repair the workflow header

name is concatenated onto the permissions value on line 2, which breaks the YAML, and there is a second top-level permissions block later in the file. Keep a single valid name: and one top-level permissions: block.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ci-python.yml around lines 1 - 2, Repair the workflow
header so `name:` is a separate top-level key rather than concatenated with
`permissions:`, and remove the duplicate top-level `permissions` declaration
later in the workflow. Preserve a single valid workflow name and one permissions
block containing the intended settings.


on:
push:
Expand All @@ -13,6 +14,9 @@ on:
- 'backend/**'
- 'requirements*.txt'

permissions:
contents: read

concurrency:
group: ci-python-${{ github.ref }}
cancel-in-progress: true
Expand Down
4 changes: 3 additions & 1 deletion .github/workflows/ci-security.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,7 @@
name: \uD83D\uDD12 Security Scan

permissions read
on:
read
on:
workflow_call:
inputs:
Expand Down
3 changes: 2 additions & 1 deletion .github/workflows/ci-unit.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,8 @@ name: \uD83E\uDDEA Unit Tests

on:
workflow_dispatch:

permissions:
contents: read
jobs:
python-unit:
name: Python Unit Tests
Expand Down
4 changes: 4 additions & 0 deletions .github/workflows/docker-build.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,9 @@
name: Docker Build & Test

permissions:
contents: read
on:
read
on:
push:
branches: [ main, develop ]
Expand Down
4 changes: 4 additions & 0 deletions .github/workflows/docker-push.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,9 @@
name: Docker Push to Registry

permissions:
contents: read
on:
read
on:
push:
branches: [ main ]
Expand Down
4 changes: 4 additions & 0 deletions .github/workflows/docker.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,9 @@
name: Docker Build & Verify

permissions:
contents: read
on:
read
Comment on lines +3 to +6

@coderabbitai coderabbitai Bot Jul 15, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

files=(
  .github/workflows/docker.yml
  .github/workflows/docs-check.yml
  .github/workflows/docs-lint.yml
  .github/workflows/evo-harness.yml
  .github/workflows/health-check.yml
  .github/workflows/trivy-scan.yml
  .github/workflows/trivy-weekly.yml
)

for f in "${files[@]}"; do
  echo "===== $f ====="
  nl -ba "$f" | sed -n '1,40p'
  echo
done

Repository: welshDog/HyperCode-V2.4

Length of output: 243

🏁 Script executed:

#!/bin/bash
set -euo pipefail

python3 - <<'PY'
from pathlib import Path

files = [
    Path('.github/workflows/docker.yml'),
    Path('.github/workflows/docs-check.yml'),
    Path('.github/workflows/docs-lint.yml'),
    Path('.github/workflows/evo-harness.yml'),
    Path('.github/workflows/health-check.yml'),
    Path('.github/workflows/trivy-scan.yml'),
    Path('.github/workflows/trivy-weekly.yml'),
]

for p in files:
    print(f"===== {p} =====")
    text = p.read_text()
    for i, line in enumerate(text.splitlines(), 1):
        if i <= 30:
            print(f"{i:>4}: {line}")
    print()
PY

Repository: welshDog/HyperCode-V2.4

Length of output: 5771

🏁 Script executed:

#!/bin/bash
set -euo pipefail

python3 - <<'PY'
import re
from pathlib import Path

files = [
    Path('.github/workflows/docker.yml'),
    Path('.github/workflows/docs-check.yml'),
    Path('.github/workflows/docs-lint.yml'),
    Path('.github/workflows/evo-harness.yml'),
    Path('.github/workflows/health-check.yml'),
    Path('.github/workflows/trivy-scan.yml'),
    Path('.github/workflows/trivy-weekly.yml'),
]

for p in files:
    txt = p.read_text()
    m = re.search(r'^\s*on:\s*read\s*$', txt, flags=re.M)
    print(f"{p}: {'HAS on: read' if m else 'NO on: read'}")
PY

Repository: welshDog/HyperCode-V2.4

Length of output: 490

🏁 Script executed:

#!/bin/bash
set -euo pipefail

python3 - <<'PY'
from pathlib import Path

files = [
    Path('.github/workflows/docker.yml'),
    Path('.github/workflows/docs-check.yml'),
    Path('.github/workflows/docs-lint.yml'),
    Path('.github/workflows/evo-harness.yml'),
    Path('.github/workflows/health-check.yml'),
    Path('.github/workflows/trivy-scan.yml'),
    Path('.github/workflows/trivy-weekly.yml'),
]

for p in files:
    print(f"===== {p} =====")
    for i, line in enumerate(p.read_text().splitlines(), 1):
        if i <= 20:
            print(f"{i:>4}: {line}")
    print()
PY

Repository: welshDog/HyperCode-V2.4

Length of output: 3618

🏁 Script executed:

#!/bin/bash
set -euo pipefail

python3 - <<'PY'
import re
from pathlib import Path

files = [
    Path('.github/workflows/docker.yml'),
    Path('.github/workflows/docs-check.yml'),
    Path('.github/workflows/docs-lint.yml'),
    Path('.github/workflows/evo-harness.yml'),
    Path('.github/workflows/health-check.yml'),
    Path('.github/workflows/trivy-scan.yml'),
    Path('.github/workflows/trivy-weekly.yml'),
]

for p in files:
    txt = p.read_text()
    has = bool(re.search(r'^\s*on:\s*read\s*$', txt, flags=re.M))
    print(f"{p}: {'HAS on: read' if has else 'NO on: read'}")
PY

Repository: welshDog/HyperCode-V2.4

Length of output: 490

Remove the stray on: read trigger from these workflows

read is not a workflow event, and the extra on: block leaves each file with a malformed trigger section. Remove it from:

  • .github/workflows/docker.yml
  • .github/workflows/docs-check.yml
  • .github/workflows/docs-lint.yml
  • .github/workflows/evo-harness.yml
  • .github/workflows/health-check.yml
  • .github/workflows/trivy-scan.yml
  • .github/workflows/trivy-weekly.yml
📍 Affects 7 files
  • .github/workflows/docker.yml#L3-L6 (this comment)
  • .github/workflows/docs-check.yml#L3-L6
  • .github/workflows/docs-lint.yml#L3-L6
  • .github/workflows/evo-harness.yml#L6-L9
  • .github/workflows/health-check.yml#L3-L6
  • .github/workflows/trivy-scan.yml#L3-L6
  • .github/workflows/trivy-weekly.yml#L3-L6
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/docker.yml around lines 3 - 6, Remove the stray “on: read”
trigger from .github/workflows/docker.yml (lines 3-6),
.github/workflows/docs-check.yml (lines 3-6), .github/workflows/docs-lint.yml
(lines 3-6), .github/workflows/evo-harness.yml (lines 6-9),
.github/workflows/health-check.yml (lines 3-6), .github/workflows/trivy-scan.yml
(lines 3-6), and .github/workflows/trivy-weekly.yml (lines 3-6), preserving each
workflow’s valid triggers and permissions.

on:
push:
branches: [ "main" ]
Expand Down
4 changes: 4 additions & 0 deletions .github/workflows/docs-check.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,9 @@
name: Docs Check

permissions:
contents: read
on:
read
on:
pull_request:
paths:
Expand Down
4 changes: 4 additions & 0 deletions .github/workflows/docs-lint.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,9 @@
name: Docs Lint

permissions:
contents: read
on:
read
on:
pull_request:
paths:
Expand Down
4 changes: 4 additions & 0 deletions .github/workflows/evo-harness.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,10 @@ name: Evo Harness — Long-Horizon Regression
# P2-1 — keeps HyperCode GREEN across multi-phase changes (separate from Trivy).
# CI-safe: parses docs/ROADMAP.md → milestone DAG → scores. No stack, no rollback.

permissions:
contents: read
on:
read
on:
push:
branches: [main]
Expand Down
4 changes: 4 additions & 0 deletions .github/workflows/health-check.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,9 @@
name: 💚 HyperCode Health Check

permissions:
contents: read
on:
read
on:
push:
branches: [main]
Expand Down
4 changes: 4 additions & 0 deletions .github/workflows/health.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,9 @@
name: Health Checks

permissions:
contents: read
on:
read
Comment on lines +5 to +6

@coderabbitai coderabbitai Bot Jul 15, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🔴 Critical | ⚡ Quick win

Remove invalid on: read event trigger.

The read value is not a recognised GitHub Actions event trigger. This appears to be a copy-paste error from the permissions block and will break the workflow due to an invalid trigger schema, likely resulting in a duplicate on key parsing error.

  • .github/workflows/health.yml#L5-L6: remove the on: read lines.
  • .github/workflows/hyper-agents-ci.yml#L5-L6: remove the on: read lines.
  • .github/workflows/hyper-agents-gate2-e2e.yml#L5-L6: remove the on: read lines.
  • .github/workflows/iac-scan.yml#L5-L6: remove the on: read lines.
  • .github/workflows/lean-review.yml#L5-L6: remove the on: read lines.
📍 Affects 5 files
  • .github/workflows/health.yml#L5-L6 (this comment)
  • .github/workflows/hyper-agents-ci.yml#L5-L6
  • .github/workflows/hyper-agents-gate2-e2e.yml#L5-L6
  • .github/workflows/iac-scan.yml#L5-L6
  • .github/workflows/lean-review.yml#L5-L6
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/health.yml around lines 5 - 6, Remove the invalid on: read
trigger from .github/workflows/health.yml lines 5-6,
.github/workflows/hyper-agents-ci.yml lines 5-6,
.github/workflows/hyper-agents-gate2-e2e.yml lines 5-6,
.github/workflows/iac-scan.yml lines 5-6, and .github/workflows/lean-review.yml
lines 5-6, leaving each workflow’s valid triggers and permissions unchanged.

on:
workflow_dispatch:

Expand Down
4 changes: 4 additions & 0 deletions .github/workflows/hyper-agents-ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,9 @@
name: Hyper Agents CI

permissions:
contents: read
on:
read
on:
push:
branches:
Expand Down
4 changes: 4 additions & 0 deletions .github/workflows/hyper-agents-gate2-e2e.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,9 @@
name: Hyper Agents Gate 2 — E2E & Full Stack

permissions:
contents: read
on:
read
on:
pull_request:
branches:
Expand Down
4 changes: 4 additions & 0 deletions .github/workflows/iac-scan.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,9 @@
name: IaC & Dockerfile Scan

permissions:
contents: read
on:
read
on:
push:
branches: [main, master]
Expand Down
5 changes: 5 additions & 0 deletions .github/workflows/lean-review.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,9 @@
name: Lean Duplicate Review

permissions:
contents: read
on:
read
on:
push:
paths:
Expand Down
5 changes: 5 additions & 0 deletions .github/workflows/no-legacy-paths.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,9 @@
name: No Legacy Paths Guard

permissions:
contents: read
on:
read
Comment on lines +5 to +6

@coderabbitai coderabbitai Bot Jul 15, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

for f in \
  .github/workflows/no-legacy-paths.yml \
  .github/workflows/performance.yml \
  .github/workflows/playwright-dashboard.yml \
  .github/workflows/promote-dashboards.yml \
  .github/workflows/prune_audit.yml \
  .github/workflows/quality-gate.yml
do
  echo "===== $f ====="
  nl -ba "$f" | sed -n '1,40p'
  echo
done

Repository: welshDog/HyperCode-V2.4

Length of output: 252

🏁 Script executed:

#!/bin/bash
set -euo pipefail

python3 - <<'PY'
from pathlib import Path

files = [
    ".github/workflows/no-legacy-paths.yml",
    ".github/workflows/performance.yml",
    ".github/workflows/playwright-dashboard.yml",
    ".github/workflows/promote-dashboards.yml",
    ".github/workflows/prune_audit.yml",
    ".github/workflows/quality-gate.yml",
]

for file in files:
    print(f"===== {file} =====")
    text = Path(file).read_text()
    for i, line in enumerate(text.splitlines(), 1):
        if 1 <= i <= 30:
            print(f"{i:4d}: {line}")
    print()
PY

Repository: welshDog/HyperCode-V2.4

Length of output: 5357

🏁 Script executed:

#!/bin/bash
set -euo pipefail
nl -ba .github/workflows/no-legacy-paths.yml | sed -n '1,20p'

Repository: welshDog/HyperCode-V2.4

Length of output: 201

🏁 Script executed:

python3 - <<'PY'
from pathlib import Path
import sys

try:
    import yaml
except Exception as e:
    print(f"PyYAML unavailable: {e}")
    sys.exit(0)

files = [
    ".github/workflows/no-legacy-paths.yml",
    ".github/workflows/performance.yml",
    ".github/workflows/playwright-dashboard.yml",
    ".github/workflows/promote-dashboards.yml",
    ".github/workflows/prune_audit.yml",
    ".github/workflows/quality-gate.yml",
]

for file in files:
    text = Path(file).read_text()
    print(f"===== {file} =====")
    try:
        data = yaml.safe_load(text)
        top = list(data.keys()) if isinstance(data, dict) else type(data).__name__
        print("loaded:", top)
        print("on:", data.get("on") if isinstance(data, dict) else None)
        print("permissions:", data.get("permissions") if isinstance(data, dict) else None)
    except Exception as e:
        print("parse error:", type(e).__name__, e)
PY

Repository: welshDog/HyperCode-V2.4

Length of output: 1072

🏁 Script executed:

python3 - <<'PY'
from pathlib import Path
import yaml

files = [
    ".github/workflows/no-legacy-paths.yml",
    ".github/workflows/performance.yml",
    ".github/workflows/playwright-dashboard.yml",
    ".github/workflows/promote-dashboards.yml",
    ".github/workflows/prune_audit.yml",
    ".github/workflows/quality-gate.yml",
]

def dump(node, indent=0):
    pad = "  " * indent
    if isinstance(node, yaml.ScalarNode):
        print(f"{pad}Scalar(tag={node.tag!r}, value={node.value!r})")
    elif isinstance(node, yaml.SequenceNode):
        print(f"{pad}Sequence(tag={node.tag!r})")
        for item in node.value:
            dump(item, indent + 1)
    elif isinstance(node, yaml.MappingNode):
        print(f"{pad}Mapping(tag={node.tag!r})")
        for k, v in node.value:
            print(f"{pad}  Key:")
            dump(k, indent + 2)
            print(f"{pad}  Value:")
            dump(v, indent + 2)
    else:
        print(f"{pad}{type(node).__name__}")

for file in files:
    print(f"===== {file} =====")
    root = yaml.compose(Path(file).read_text())
    dump(root)
    print()
PY

Repository: welshDog/HyperCode-V2.4

Length of output: 48294

Remove the stray on: read entries
Each workflow has a duplicate on: key; delete the read scalar and keep the trigger map below it:

  • .github/workflows/no-legacy-paths.yml
  • .github/workflows/performance.yml
  • .github/workflows/playwright-dashboard.yml
  • .github/workflows/promote-dashboards.yml
  • .github/workflows/prune_audit.yml
  • .github/workflows/quality-gate.yml
📍 Affects 6 files
  • .github/workflows/no-legacy-paths.yml#L5-L6 (this comment)
  • .github/workflows/performance.yml#L6-L7
  • .github/workflows/playwright-dashboard.yml#L5-L6
  • .github/workflows/promote-dashboards.yml#L5-L6
  • .github/workflows/prune_audit.yml#L5-L6
  • .github/workflows/quality-gate.yml#L9-L10
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/no-legacy-paths.yml around lines 5 - 6, Remove the stray
“on: read” entries and retain each workflow’s following trigger map. Apply this
change in .github/workflows/no-legacy-paths.yml (lines 5-6),
.github/workflows/performance.yml (lines 6-7),
.github/workflows/playwright-dashboard.yml (lines 5-6),
.github/workflows/promote-dashboards.yml (lines 5-6),
.github/workflows/prune_audit.yml (lines 5-6), and
.github/workflows/quality-gate.yml (lines 9-10).

on:
push:
branches:
Expand Down
4 changes: 4 additions & 0 deletions .github/workflows/performance.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,10 @@

name: Performance Testing

permissions:
contents: read
on:
read
on:
workflow_dispatch:

Expand Down
4 changes: 4 additions & 0 deletions .github/workflows/playwright-dashboard.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,9 @@
name: Playwright Dashboard E2E

permissions:
contents: read
on:
read
on:
workflow_dispatch:
push:
Expand Down
4 changes: 4 additions & 0 deletions .github/workflows/promote-dashboards.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,9 @@
name: Promote dashboards to Grafana Cloud

permissions:
contents: read
on:
read
on:
push:
branches: [main]
Expand Down
4 changes: 4 additions & 0 deletions .github/workflows/prune_audit.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,9 @@
name: Prune Celery Task Audit

permissions:
contents: read
on:
read
on:
schedule:
- cron: '0 3 * * *'
Expand Down
4 changes: 4 additions & 0 deletions .github/workflows/quality-gate.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,10 @@ name: Quality Gate — Master Orchestrator
# It calls the specialist workflows and enforces thresholds from
# quality-gate-thresholds.yml.

permissions:
contents: read
on:
read
on:
push:
branches: [main, master]
Expand Down
5 changes: 4 additions & 1 deletion .github/workflows/secret-redaction-guard.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,10 @@ on:
push:
branches: [ "main", "production", "feature/**", "fix/**" ]
workflow_dispatch:

permissions:
contents: read
on:
read
jobs:
guard:
runs-on: ubuntu-latest
Expand Down
6 changes: 6 additions & 0 deletions .github/workflows/security-comprehensive.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,11 @@
name: Security — Comprehensive Scan

permissions:
contents: read
on:
read
on:
read
Comment on lines +5 to +8

@coderabbitai coderabbitai Bot Jul 15, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🔴 Critical | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '\n## security-comprehensive.yml\n'
cat -n .github/workflows/security-comprehensive.yml | sed -n '1,120p'

printf '\n## secret-redaction-guard.yml\n'
cat -n .github/workflows/secret-redaction-guard.yml | sed -n '1,120p'

printf '\n## sse-tests.yml\n'
cat -n .github/workflows/sse-tests.yml | sed -n '1,120p'

printf '\n## ci-cd.yml\n'
cat -n .github/workflows/ci-cd.yml | sed -n '1,160p'

Repository: welshDog/HyperCode-V2.4

Length of output: 11684

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '\n## security-comprehensive.yml outline\n'
ast-grep outline .github/workflows/security-comprehensive.yml || true

printf '\n## secret-redaction-guard.yml outline\n'
ast-grep outline .github/workflows/secret-redaction-guard.yml || true

printf '\n## sse-tests.yml outline\n'
ast-grep outline .github/workflows/sse-tests.yml || true

printf '\n## ci-cd.yml outline\n'
ast-grep outline .github/workflows/ci-cd.yml || true

Repository: welshDog/HyperCode-V2.4

Length of output: 493

🏁 Script executed:

#!/bin/bash
set -euo pipefail

rg -n "on:\s*read|security-events:\s*write|sarif|permissions:" .github/workflows/security-comprehensive.yml .github/workflows/secret-redaction-guard.yml .github/workflows/sse-tests.yml .github/workflows/ci-cd.yml

Repository: welshDog/HyperCode-V2.4

Length of output: 2041

🏁 Script executed:

#!/bin/bash
set -euo pipefail

python3 - <<'PY'
from pathlib import Path
import sys

try:
    import yaml
except Exception as e:
    print(f"PyYAML unavailable: {e}")
    sys.exit(0)

files = [
    ".github/workflows/security-comprehensive.yml",
    ".github/workflows/secret-redaction-guard.yml",
    ".github/workflows/sse-tests.yml",
]

for path in files:
    text = Path(path).read_text()
    print(f"\n## {path}")
    try:
        data = yaml.safe_load(text)
        print("top-level keys:", list(data.keys()) if isinstance(data, dict) else type(data))
        on_value = data.get("on") if isinstance(data, dict) else None
        print("parsed on:", on_value)
    except Exception as e:
        print("parse error:", type(e).__name__, e)
PY

Repository: welshDog/HyperCode-V2.4

Length of output: 527

Remove the stray on: read entries. read is not a valid workflow event, and the extra on: key in .github/workflows/security-comprehensive.yml leaves the trigger block malformed.

  • .github/workflows/security-comprehensive.yml#L5-L8: remove both added on: read lines and keep the existing trigger block.
  • .github/workflows/secret-redaction-guard.yml#L9-L10: remove the added on: read.
  • .github/workflows/sse-tests.yml#L5-L6: remove the added on: read.
📍 Affects 3 files
  • .github/workflows/security-comprehensive.yml#L5-L8 (this comment)
  • .github/workflows/secret-redaction-guard.yml#L9-L10
  • .github/workflows/sse-tests.yml#L5-L6
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/security-comprehensive.yml around lines 5 - 8, Remove the
stray on: read entries from .github/workflows/security-comprehensive.yml lines
5-8, .github/workflows/secret-redaction-guard.yml lines 9-10, and
.github/workflows/sse-tests.yml lines 5-6; preserve each workflow’s existing
valid trigger block.

on:
push:
branches: [main] # ← main only, never feature branches
Expand Down
4 changes: 4 additions & 0 deletions .github/workflows/sse-tests.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,9 @@
name: Fast SSE Tests

permissions:
contents: read
on:
read
on:
push:
paths:
Expand Down
4 changes: 4 additions & 0 deletions .github/workflows/swarm-pipeline.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,9 @@
name: Swarm Pipeline

permissions:
contents: read
on:
read
on:
workflow_dispatch:

Expand Down
4 changes: 4 additions & 0 deletions .github/workflows/tests.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,9 @@
name: Tests & Quality

permissions:
contents: read
on:
read
on:
workflow_call:
schedule:
Expand Down
4 changes: 4 additions & 0 deletions .github/workflows/trivy-scan.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,9 @@
name: Trivy Security Scan

permissions:
contents: read
on:
read
on:
push:
branches: [main] # ← main only
Expand Down
4 changes: 4 additions & 0 deletions .github/workflows/trivy-weekly.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,9 @@
name: 🔒 Weekly Fleet Security Scan

permissions:
contents: read
on:
read
on:
schedule:
- cron: '0 6 * * 1' # Every Monday 06:00 UTC
Expand Down
1 change: 1 addition & 0 deletions HyperCode-V2.4
Open in desktop
Submodule HyperCode-V2.4 added at 2fbbcb
Loading
Loading