fix(ci): propagate reusable workflow permissions at caller scope#30
Merged
fix(ci): propagate reusable workflow permissions at caller scope#30
Conversation
|
Note Gemini is unable to generate a summary for this pull request due to the file types involved not being currently supported. |
Reviewer's guide (collapsed on small PRs)Reviewer's GuideSets required GitHub token permissions at the workflow (caller) level for the manual review reusable workflows, adds targeted zizmor suppressions to justify these elevated permissions, and removes now-redundant job-level permission blocks so that permissions propagate correctly to the reusable workflows. Sequence diagram for manual review workflow calling reusable workflow with propagated permissionssequenceDiagram
actor Dev as developer
participant GH as github_actions
participant Caller as caller_workflow_manual
participant Reuse as reusable_review_workflow
participant Azure as azure_oidc_target
Dev->>GH: trigger workflow_dispatch
GH->>Caller: start claude-review-manual or opencode-review-manual
Caller->>Caller: apply workflow-level permissions
Caller->>Reuse: call reusable workflow with inherited token
Reuse->>GH: use token with contents read
Reuse->>GH: use token with pull-requests write and issues write
Reuse->>Azure: perform oidc login with id-token write
Reuse-->>GH: complete review jobs
GH-->>Dev: report workflow status
Flow diagram for GitHub Actions permission definition after CI fixflowchart TD
A[Manual dispatch of claude-review-manual or opencode-review-manual] --> B[Evaluate workflow-level permissions]
B --> C{Permissions sufficient
for reusable workflow?}
C -- Yes --> D[Call reusable review workflow
with inherited token]
C -- No (previous behavior) --> E[Startup failure before jobs execute]
D --> F[Reusable workflow performs PR and issue operations]
D --> G[Reusable workflow performs Azure OIDC login]
F --> H[Review jobs complete]
G --> H
H --> I[Workflow succeeds]
subgraph After_Change
B
C
D
F
G
H
I
end
subgraph Before_Change
A
E
end
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
Review Summary by QodoFix permission propagation for reusable review workflows
WalkthroughsDescription• Move permissions from job-level to workflow-level scope • Add zizmor inline suppressions for excessive-permissions warnings • Fix permission propagation for reusable manual review workflows Diagramflowchart LR
A["Job-level permissions"] -->|Move to| B["Workflow-level permissions"]
B -->|Add suppressions| C["zizmor ignore annotations"]
C -->|Enable| D["Reusable workflow access"]
File Changes1. .github/workflows/claude-review-manual.yml
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've left some high level feedback:
- Since both workflows now require the same elevated permissions, consider adding a brief shared comment (or central configuration for zizmor) explaining why these scopes are needed instead of repeating inline suppressions on each permission field.
- If
id-token: writeis only needed for Azure OIDC within specific reusable workflow steps, consider whether it can be scoped more narrowly (e.g., only for those workflows or jobs) to reduce the default token surface.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- Since both workflows now require the same elevated permissions, consider adding a brief shared comment (or central configuration for zizmor) explaining why these scopes are needed instead of repeating inline suppressions on each permission field.
- If `id-token: write` is only needed for Azure OIDC within specific reusable workflow steps, consider whether it can be scoped more narrowly (e.g., only for those workflows or jobs) to reduce the default token surface.Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
Code Review by Qodo
1. Workflow-wide elevated perms
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
zizmorinline suppressions for caller-levelexcessive-permissionsWhy
Manual dispatch runs were failing at startup before jobs executed, indicating permission propagation issues for reusable workflows.
Validation
Summary by Sourcery
CI: