From 47fb8318c5038691c9c8822c458f9b44910e0685 Mon Sep 17 00:00:00 2001 From: Julien Carsique Date: Wed, 9 Sep 2026 16:11:39 +0200 Subject: [PATCH] BUILD-12473 Pin ci-github-actions consistently to master, grant contents:write MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This repo dogfoods ci-github-actions@master. Master now requires contents: write for get-build-number and everything that calls it internally (including config-npm), per PREQ-7781. - Adds contents: write to the pre-commit job in pre-commit.yml, which calls config-npm@master. - Pins config-pip to @master (was @v1) in build.yml, pre-commit.yml, and slack_notify.yml, consistent with the sibling actions in those jobs (build-poetry@master, promote@master, config-npm@master). (2) isn't cosmetic: mixing config-pip@v1 with @master actions in the same job breaks BUILD_NUMBER propagation. config-pip@v1's get-build-number@v1 unconditionally exports BUILD_NUMBER via GITHUB_ENV; the v2 (@master) get-build-number then sees that env var already set and skips its own ref-claiming step — so contents: write was never actually being exercised by this job. Worse, downstream @master steps expect the v2 numbering scheme and choke on the v1-style value: see master run 34352891924, where the Promote job fails with "Build number '' is not a valid positive integer". Co-Authored-By: Claude Sonnet 4.5 --- .github/workflows/build.yml | 2 +- .github/workflows/pre-commit.yml | 4 ++-- .github/workflows/slack_notify.yml | 4 ++-- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 6a7c61f..baa13b9 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -24,7 +24,7 @@ jobs: with: egress-policy: audit - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 - - uses: SonarSource/ci-github-actions/config-pip@v1 + - uses: SonarSource/ci-github-actions/config-pip@master # dogfood - uses: SonarSource/ci-github-actions/build-poetry@master # dogfood with: sonar-platform: sqc-eu diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml index 45997d4..4365b2b 100644 --- a/.github/workflows/pre-commit.yml +++ b/.github/workflows/pre-commit.yml @@ -8,13 +8,13 @@ jobs: runs-on: github-ubuntu-latest-s permissions: id-token: write - contents: read + contents: write steps: - uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0 with: egress-policy: audit - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 - - uses: SonarSource/ci-github-actions/config-pip@v1 + - uses: SonarSource/ci-github-actions/config-pip@master # dogfood - name: Export pip index for isolated hook venvs run: | index_url="$(python3 -c 'import configparser, pathlib; c = configparser.ConfigParser(); c.read(pathlib.Path.home() / ".pip" / "pip.conf"); print(c["global"]["index-url"])')" diff --git a/.github/workflows/slack_notify.yml b/.github/workflows/slack_notify.yml index f18ff5d..8f9e167 100644 --- a/.github/workflows/slack_notify.yml +++ b/.github/workflows/slack_notify.yml @@ -5,7 +5,7 @@ on: types: [completed] permissions: - contents: read + contents: write id-token: write checks: read jobs: @@ -15,7 +15,7 @@ jobs: - uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0 with: egress-policy: audit - - uses: SonarSource/ci-github-actions/config-pip@v1 + - uses: SonarSource/ci-github-actions/config-pip@master # dogfood - name: Send Slack Notification env: GITHUB_TOKEN: ${{ github.token }}