Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Improve handling of unknown permissions #27

Open
jsoref opened this issue Dec 28, 2023 · 1 comment
Open

Improve handling of unknown permissions #27

jsoref opened this issue Dec 28, 2023 · 1 comment

Comments

@jsoref
Copy link
Contributor

jsoref commented Dec 28, 2023

The current code is unhelpful for various reasons:

if (kind === 'unknown') {
console.log(`The github token was used to call ${result.method} ${result.host}${result.path} but the permission is unknown. Please report this to the action author.`);

  1. It generates markdown with a workflow snippet like:

    Minimal required permissions:

    permissions:
      security-events: write
      pull-requests: read
      unknown: unknown

    But if someone were to add this permission, it'd result in the workflow failing:
    image

  2. It doesn't use at least ::warning or similar to call out the item https://github.com/jsoref/check-spelling/actions/runs/7331431111/job/19964051747#step:12:2

  3. The grammar in the readme is off:

    * GitHub GraphQL API usage is not monitored. It would requires parsing and understanding the GraphQL queries. Pull-requests are welcome.

    -It would requires parsing
    +It would require parsing

Expected results

  1. Don't generate invalid workflow content
  2. Do use # ... in the generated workflow content
  3. Do surface the api call(s) -- if you're afraid of surfacing things, provide the client User-Agent, it should be possible to at least identify the objects being queried
@JarLob
Copy link
Contributor

JarLob commented Jul 8, 2024

Thank you for the feedback. I have created #29 for unknown permissions.
As for Do surface the api call(s) have tried

* `debug` - if set to `true`, the Monitor action will print additional debug information to the console. The default value is `false`. (Alternatively, debug logging can be enabled by restarting the runner with the debug checkbox marked or passing `debug` input parameter to the action.)
? It provides much more logging.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants