fix: remediate Dependabot security alerts (2026-06-02)#360
Closed
typeagent-bot[bot] wants to merge 3 commits into
Closed
fix: remediate Dependabot security alerts (2026-06-02)#360typeagent-bot[bot] wants to merge 3 commits into
typeagent-bot[bot] wants to merge 3 commits into
Conversation
Add a temporary diagnostic step that prints what the refreshed App token can see on the repo, the install's repo selection, and a git/refs read probe, so we can see exactly why git push 403s. To be reverted once the underlying permission/install issue is fixed. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Match the TypeAgent workflow pattern: keep persist-credentials: false on checkout (so the token isn't reachable from npm scripts during the verify phase), but at the very end of the job re-inject the workflow's own GITHUB_TOKEN (already scoped to contents:write at the workflow level) for the git push. The App token is now used only where it must be — gh api dependabot/ alerts (which the default token can't reach) and gh pr create (so the PR identity is the bot, not github-actions). Means the App no longer needs Contents permission at all. Also removes the temporary diagnostic step that confirmed the permission issue. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Automated by fix-dependabot-alerts workflow. Applied:minimatch Rolled back: Unfixable: 3 package(s) Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Contributor
|
Closing — this PR was created by a manual After #361 lands, the next scheduled run (or manual trigger from main) will produce a clean PR containing only the |
TalZaccai
added a commit
that referenced
this pull request
Jun 2, 2026
The fix-dependabot-alerts workflow was using the GitHub App token for git push, which required granting the App `Contents: write` at the installation level. That permission wasn't (and didn't need to be) granted, causing the scheduled run to 403 at `git push` with 'Permission to microsoft/TypeChat.git denied to typeagent-bot[bot]'. Match the TypeAgent workflow pattern instead: keep `persist-credentials: false` on checkout (so the token isn't reachable from untrusted `npm` scripts during the verify phase), but at the very end of the job re-inject the workflow's own GITHUB_TOKEN — already scoped to `contents: write` via the workflow-level `permissions:` block — for the git push. The App token is now used only where it must be: - `gh api dependabot/alerts` (the default GITHUB_TOKEN can't reach this endpoint) - `gh pr create` / labels / closing superseded PRs (so the PR identity is the bot, not github-actions) Verified end-to-end: a manual workflow_dispatch run against a temp branch passed git push and opened #360. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Automated Dependabot Alert Remediation
This PR was generated by the
fix-dependabot-alertsworkflow.Each fix was applied individually and verified against
npm ci,npm run build, andnpm testbefore inclusion.Summary
overrides: (none)How this works
npm update <pkg> --package-lock-only, then rootoverridesentry.package-lock.jsonis ≥ the advisory'sfirst_patched_version.npm ci,npm run build, andnpm test; rolls back on failure and records a 7-day cooldown.Review checklist
overrideswere added, confirm the pinned version is acceptable policy