-
Notifications
You must be signed in to change notification settings - Fork 2
Update to ACK runtime v0.56.0, code-generator v0.56.0
#9
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
|
|
||
| jobs: | ||
| call-hydrate-go-proxy: | ||
| uses: aws-controllers-k8s/.github/.github/workflows/reusable-postsubmit.yaml@main |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 6 days ago
To fix the problem, we should add an explicit permissions block to the job definition (or at the workflow root), specifying only the minimal permissions required. Because this workflow delegates work to a reusable workflow using uses:, the permissions in this file control what is granted to the called workflow unless it further restricts them. As a safe minimal default, set all permissions to read (or none if absolutely no access is needed), and grant more if the called workflow requires it. The best place to insert the permissions block for a single-job workflow is at the job level, just before (or after) the uses line in job definition. Since we don't know the specific needs of the called workflow, we should use the recommended least privilege starting point, such as:
permissions:
contents: readIf you know more is needed, you could expand this. For now, insert this block under the job call-hydrate-go-proxy:.
-
Copy modified lines R10-R11
| @@ -7,4 +7,6 @@ | ||
|
|
||
| jobs: | ||
| call-hydrate-go-proxy: | ||
| permissions: | ||
| contents: read | ||
| uses: aws-controllers-k8s/.github/.github/workflows/reusable-postsubmit.yaml@main |
|
@ack-bot: The following test failed, say
Full PR test history. Your PR dashboard. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here. |
|
/lgtm |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: a-hilaly, ack-bot The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
Update to ACK runtime
v0.56.0, code-generatorv0.56.0v0.56.0release notesv0.56.0release notesNOTE:
This PR increments the release version of service controller from
v1.0.1tov1.1.0Once this PR is merged, release
v1.1.0will be automatically created forbedrockagentcorecontrol-controllerPlease close this PR, if you do not want the new patch release for
bedrockagentcorecontrol-controllerstdout for
make build-controller:By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.