ci: fix permissions for GITHUB_TOKEN in spell check workflow #22545
Conversation
📝 WalkthroughWalkthroughThe pull request modifies the GitHub Actions workflow for spell checking by adding a Changes
Possibly related PRs
Suggested reviewers
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
Documentation and Community
|
auricom
force-pushed
the
claude/spellcheck
branch
from
e48b813 to
4d55822
Compare
|
Test was successful : PR has been opened #22546 |
auricom
changed the title
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Outside diff range and nitpick comments (1)
.github/workflows/misspell.yml (1)
Line range hint
25-36: Consider adding additional safeguards for automated PR creation.The workflow automatically creates PRs on a schedule, which is generally fine. However, consider adding:
- A limit on the number of concurrent PRs
- Branch protection rules for the target branch
- Required reviewers for the automated PRs
📜 Review details
Configuration used: .coderabbit.yml
Review profile: CHILL
📒 Files selected for processing (1)
.github/workflows/misspell.yml(1 hunks)
🔇 Additional comments (2)
.github/workflows/misspell.yml (2)
8-11: LGTM! Permissions are correctly configured.
The added permissions block properly defines the minimum required permissions for the workflow to function. This follows security best practices and addresses the automation trigger issues.
Line range hint 21-24: Verify the security implications of continue-on-error.
While the workflow configuration is generally sound, the continue-on-error: true flag could potentially mask important issues. Consider adding error logging or notifications for failed spell checks.
Run this script to check for potential security implications:
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Outside diff range and nitpick comments (2)
.github/workflows/misspell.yml (2)
14-14: Consider pinning the Ubuntu version explicitly.While
ubuntu-latestworks, consider using a specific version likeubuntu-22.04for better reproducibility and to avoid unexpected changes when the latest version is updated.- runs-on: ubuntu-latest + runs-on: ubuntu-22.04
Line range hint
21-22: Document the file exclusion patterns.Consider adding a comment explaining why certain files are excluded from spell checking. This helps future maintainers understand the rationale.
run: | sudo apt-get install codespell -y + # Skip generated files (*.pb.go, *.cosmos_orm.go), binary files, and external dependencies codespell -w --skip="*.pulsar.go,*.pb.go,*.pb.gw.go,*.cosmos_orm.go,*.json,*.git,*.js,crypto/keys,fuzz,*.h,proto/tendermint,*.bin,go.sum,go.mod" --ignore-words=.github/.codespellignore
📜 Review details
Configuration used: .coderabbit.yml
Review profile: CHILL
📒 Files selected for processing (1)
.github/workflows/misspell.yml(1 hunks)
🔇 Additional comments (1)
.github/workflows/misspell.yml (1)
8-11: LGTM! Permissions are correctly configured.
The added permissions block grants the necessary write access for both repository contents and pull requests, which is required for the spell check workflow to create automated fix PRs. This aligns with GitHub's security best practices.
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Outside diff range and nitpick comments (1)
.github/workflows/misspell.yml (1)
Line range hint
1-24: Consider pinning versions for better reproducibilityWhile the security improvements with permissions are great, consider these enhancements:
- Pin the Ubuntu runner to a specific version (e.g.,
ubuntu-22.04)- Specify the codespell version in the installation command
- runs-on: ubuntu-latest + runs-on: ubuntu-22.04 run: | - sudo apt-get install codespell -y + sudo apt-get install codespell=2.2.6-1 -y
📜 Review details
Configuration used: .coderabbit.yml
Review profile: CHILL
📒 Files selected for processing (1)
.github/workflows/misspell.yml(1 hunks)
🔇 Additional comments (2)
.github/workflows/misspell.yml (2)
8-11: LGTM! Permissions are correctly configured
The addition of explicit permissions follows GitHub's best practices for Actions security. The permissions are appropriately scoped to only what's needed for the spell check workflow.
Line range hint 1-24: Verify workflow execution
Let's confirm that the workflow is triggering properly with the new permissions.
✅ Verification successful
Workflow is functioning correctly with proper permissions
The verification results show:
- The last 5 workflow runs completed successfully
- The workflow file syntax is valid and includes the necessary permissions
- The workflow is properly configured for both pull requests and scheduled runs
- The create-pull-request action has the required token configuration
🏁 Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash
# Description: Check recent workflow runs to verify the changes are working
# Check recent workflow runs for this specific workflow
gh run list --workflow "Spell Check" --limit 5 --json status,conclusion,event,createdAt \
| jq '.[].conclusion'
# Verify the workflow file syntax
gh workflow view "Spell Check" --yaml
Length of output: 1215
* main: build(deps): Bump cosmossdk.io/math from 1.3.0 to 1.4.0 (#22580) fix(server/v2/api/telemetry): enable global metrics (#22571) refactor(server/v2/cometbft): add `codec.Codec` and clean-up APIs (#22566) feat(core/coretesting): make memDB satisfy db.Db interface (#22570) Merge commit from fork fix(server(/v2)): fix fallback genesis path (#22564) fix: only overwrite context chainID when necessary (#22568) docs(client): Update setFeeGranter and setFeePayer comments (#22526) fix(baseapp): populate header info in `NewUncachedContext` (#22557) build(deps): Bump buf.build/gen/go/cometbft/cometbft/protocolbuffers/go from 1.35.1-20240701160653-fedbb9acfd2f.1 to 1.35.2-20240701160653-fedbb9acfd2f.1 in /api (#22551) build(deps): Bump github.com/creachadair/atomicfile from 0.3.5 to 0.3.6 in /tools/confix (#22552) docs: Update reference of Approximation (#22550) fix(server/v2/comebft): wire missing services + fix simulation (#21964) ci: fix permissions for GITHUB_TOKEN on dependabot workflows (#22547) ci: fix permissions for GITHUB_TOKEN in spell check workflow (#22545) build(deps): Bump google.golang.org/protobuf from 1.35.1 to 1.35.2 (#22537) fix(cosmovisor): premature upgrade on restart (#22528) fix(store/v2/pebble): handle version 0 in keys (#22524) refactor(server/v2/telemetry): swap redirects (#22520) docs: Update content in CODE_OF_CONDUCT.md (#22518)
Description
Try to fix github actions not triggered anymore by automation
Author Checklist
All items are required. Please add a note to the item if the item is not applicable and
please add links to any relevant follow up issues.
I have...
!in the type prefix if API or client breaking changeCHANGELOG.mdReviewers Checklist
All items are required. Please add a note if the item is not applicable and please add
your handle next to the items reviewed if you only reviewed selected items.
Please see Pull Request Reviewer section in the contributing guide for more information on how to review a pull request.
I have...
Summary by CodeRabbit