Add missing permissions and environment variable for documentation build #69
Conversation
WalkthroughThe workflow configuration for documentation builds was updated to set explicit read permissions for repository contents and to provide an environment variable containing the GitHub token for authenticated operations during the build process. Changes
Sequence Diagram(s)sequenceDiagram
participant GitHub Actions
participant Docs Build Job
participant Sphinx/Changelog Task
GitHub Actions->>Docs Build Job: Start with contents: read permission
Docs Build Job->>Sphinx/Changelog Task: Pass SPHINX_GITHUB_CHANGELOG_TOKEN (github.token)
Sphinx/Changelog Task->>Docs Build Job: Perform authenticated changelog/doc build
Docs Build Job->>GitHub Actions: Complete build
Possibly related PRs
Suggested labels
Poem
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
.github/workflows/docs.yaml (1)
24-26: Minimal-scope permission is correctly added – consider dropping the top-level placeholder.Granting
contents: readonly on thebuildjob is the right call and removes the implicitwritescope.
With that in place the globalpermissions: {}stanza (line 19) becomes redundant; GitHub already defaults to the extremely limitedmetadata: readwhen a workflow omits the top-level block. You can safely delete it to make the file shorter and avoid confusion.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
.github/workflows/docs.yaml(2 hunks)
🔇 Additional comments (1)
.github/workflows/docs.yaml (1)
40-42: Token exposure surface – align notation & tighten the scope if possible.
- You use
${{ github.token }}here but${{ secrets.GITHUB_TOKEN }}in the deploy job (line 65). They resolve to the same value; sticking to one notation avoids cognitive friction.- The variable is exported to every subprocess spawned by
hatch run docs:build. If the changelog plugin only needs the token to read the repo, you’re fine given the new read-only permission, but double-check the build logs to ensure the token is never echoed.- If multiple steps will need the token you might want to move the
env:block to the job level; otherwise keeping it scoped to this single step is the safest option.
Summary by CodeRabbit