Fix/token permissions id 20260911 - #774
Merged
Merged
Conversation
Removing rust-ci.yml workflow since this repository has no Rust code (Cargo.toml not present). The reusable rust-ci-reusable.yml already guards itself by detecting Cargo.toml presence, but repos without Rust code shouldn't trigger unnecessary workflow runs. Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe <vibe@mistral.ai>
…le workflows - Add persist-credentials: false to checkout action in codeql-reusable.yml - Add persist-credentials: false to checkout action in hypatia-scan-reusable.yml This prevents credential persistence in CI/CD workflows, improving security. Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe <vibe@mistral.ai>
…-level write Apply principle of least privilege for GITHUB_TOKEN: - Change top-level permissions from 'contents: write' to 'contents: read' - Add job-level 'permissions: contents: write' to jobs that need it This resolves Scorecard TokenPermissionsID alerts by following GitHub's recommended security practice of granting minimal top-level permissions and escalating only at the job level where needed. Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe <vibe@mistral.ai>
Apply principle of least privilege for GITHUB_TOKEN: - Change top-level permissions to read-only - Jobs inherit read permissions, can escalate as needed This resolves Scorecard TokenPermissionsID alerts. Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe <vibe@mistral.ai>
- Add Optimus-Branch.json for branch protection - Add Immutable-Tags.json for tag protection - Both use native GitHub rulesets API (no bypass actors) - Replaces deprecated probot/settings branch protection Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe <vibe@mistral.ai>
Contributor
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Advanced Run ID: 📒 Files selected for processing (8)
📝 SummarySummary by CodeRabbit
WalkthroughThe changes narrow GitHub Actions permissions, prevent checkout credential persistence, remove the standalone Rust CI workflow, and add active rulesets for tag and default-branch protection. ChangesRepository governance
Estimated code review effort: 3 (Moderate) | ~20 minutes Change: Bug fix Suggested reviewers: ✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. A rabbit checks the workflow gate, Comment |
JoshuaJewell
approved these changes
Sep 12, 2026
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes #
Type of change
How has this been verified?
Checklist
git commit -S).SPDX-License-Identifier(code/configMPL-2.0,prose
CC-BY-SA-4.0); I did not relicense existing files.Notes for reviewers