ci: fix vendored dependabot PRs #7306
Conversation
The main issue is AFAIK the Node.js version being used. This is now aligned with the installment of the bundle job. That is done in a secure way where we use least privileges possible.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #7306 +/- ##
==========================================
+ Coverage 86.11% 86.16% +0.04%
==========================================
Files 512 513 +1
Lines 22108 22147 +39
==========================================
+ Hits 19039 19082 +43
+ Misses 3069 3065 -4 Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
Overall package sizeSelf size: 4.44 MB Dependency sizes| name | version | self size | total size | |------|---------|-----------|------------| | import-in-the-middle | 2.0.0 | 68.46 kB | 797.03 kB | | dc-polyfill | 0.1.10 | 26.73 kB | 26.73 kB |🤖 This report was automatically generated by heaviest-objects-in-the-universe |
BenchmarksBenchmark execution time: 2026-01-22 13:06:03 Comparing candidate commit 1f619aa in PR branch Found 0 performance improvements and 0 performance regressions! Performance is the same for 232 metrics, 28 unstable metrics. |
rochdev
left a comment
rochdev
left a comment
There was a problem hiding this comment.
LGTM, but would like another review from @KSerrania as well on the security side.
| # Security: this job has write permissions but never runs installs/builds. | ||
| # It only applies the vetted patch artifact and pushes a single commit. | ||
| permissions: | ||
| contents: write |
There was a problem hiding this comment.
Minor: I see that you switched to using a dd-octo-sts token to push the commit now. Therefore, I don't think you need this contents: write permission anymore.
There was a problem hiding this comment.
I believe it would just be a fallback
The main issue is AFAIK the Node.js version being used. This is now aligned with the installment of the bundle job. That is done in a secure way where we use least privileges possible. It also fixes a version for the action.
The main issue is AFAIK the Node.js version being used. This is now aligned with the installment of the bundle job. That is done in a secure way where we use least privileges possible. It also fixes a version for the action.
The main issue is AFAIK the Node.js version being used. This is now aligned with the installment of the bundle job.
That is done in a secure way where we use least privileges possible.