ci: fix permissions + migrate to fresher action (Pr Assign) #3117
Conversation
|
🥷 Code experts: no user matched threshold 10 See details
Knowledge based on git-blame:
Knowledge based on git-blame: To learn more about /:\ gitStream - Visit our Docs |
This comment has been minimized.
This comment has been minimized.
|
Be a legend 🏆 by adding a before and after screenshot of the changes you made, especially if they are around UI/UX. |
📝 Walkthrough📝 WalkthroughWalkthroughThe pull request modifies two GitHub workflow files related to pull request management. In Changes
Possibly related PRs
Suggested labels
Suggested reviewers
📜 Recent review detailsConfiguration used: CodeRabbit UI 📒 Files selected for processing (1)
🔇 Additional comments (3).github/workflows/pr_assignee.yml (3)
The change to
The addition of explicit permissions follows GitHub's security best practices and addresses the "Resource not accessible by integration" issue mentioned in the PR objectives. Line range hint While the migration to uses: toshimaru/[email protected]
- with:
- repo-token: ${{ secrets.GITHUB_TOKEN }}Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Outside diff range and nitpick comments (1)
.github/workflows/pr_assignee.yml (1)
Line range hint
1-23: Consider updating the comment about fork limitationsThe comment at the top of the file mentions limitations specific to the old action. Please verify if these limitations still apply with the new action and update the comment accordingly.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
📒 Files selected for processing (2)
.github/workflows/pr_assignee.yml(1 hunks).github/workflows/pr_milestone.yml(1 hunks)
🔇 Additional comments (4)
.github/workflows/pr_milestone.yml (2)
9-11: LGTM! Appropriate permission scope added.
The added pull-requests: write permission is correctly scoped and necessary for the milestone action to function properly.
Line range hint 18-22: Verify the action's maintenance status
While the action version is correctly pinned for security, let's verify its maintenance status and if there are any newer versions available.
.github/workflows/pr_assignee.yml (2)
12-14: LGTM! Appropriate permission scope added.
The added pull-requests: write permission is correctly scoped and consistent with the pr_milestone.yml changes.
Line range hint 20-23: Verify the new action's compatibility and maintenance
The migration from the archived thomaseizinger/assign-pr-creator-action to toshimaru/auto-author-assign is a good move. However, let's verify:
- If the new action has the same fork author limitations
- Its current maintenance status
✅ Verification successful
Migration to toshimaru/auto-author-assign is safe and well-maintained
Based on the verification:
- The action is actively maintained (last update: Nov 2024) and not archived
- Latest release v2.1.1 (June 2024) is stable and uses Node 20
- The action has no fork-related limitations, unlike the previous action
- It has clear documentation and handles edge cases (skips bot authors and already assigned PRs)
- Open issues are mainly dependency updates, showing active maintenance
🏁 Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash
# Description: Check the new action's repository for maintenance status and documentation
echo "Checking action repository status..."
gh api repos/toshimaru/auto-author-assign \
--jq '.updated_at, .pushed_at, .archived'
# Check latest release
echo "Checking latest release..."
gh api repos/toshimaru/auto-author-assign/releases/latest \
--jq '.tag_name, .published_at'
# Search for fork-related issues or documentation
echo "Searching for fork-related documentation..."
gh api search/issues \
-f q='repo:toshimaru/auto-author-assign fork' \
--jq '.items[] | select(.state == "open") | {title, html_url}'
Length of output: 825
Script:
#!/bin/bash
# Let's check the repository's README and other documentation for fork-related information
echo "Checking README content..."
gh api repos/toshimaru/auto-author-assign/contents/README.md --jq '.content' | base64 -d
# Let's also check for any open issues that might indicate problems
echo -e "\nChecking open issues..."
gh api repos/toshimaru/auto-author-assign/issues \
--jq '.[] | select(.state == "open") | {title: .title, created_at: .created_at}'
Length of output: 1030
Script:
#!/bin/bash
# Let's try a different approach to get the README content
echo "Checking README content..."
curl -s https://raw.githubusercontent.com/toshimaru/auto-author-assign/main/README.md
# Let's also check the action.yml for configuration options
echo -e "\nChecking action.yml..."
curl -s https://raw.githubusercontent.com/toshimaru/auto-author-assign/main/action.yml
Length of output: 2236
This comment has been minimized.
This comment has been minimized.
@check-spelling-bot Report🔴 Please reviewSee the 📂 files view, the 📜action log, or 📝 job summary for details.
See ❌ Event descriptions for more information. If the flagged items are 🤯 false positivesIf items relate to a ...
|
Resource not accessible by integration