Skip to content

Upload action to alert stockplotr of new release #385

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
Schiano-NOAA wants to merge 1 commit into from
Closed

Upload action to alert stockplotr of new release #385

Schiano-NOAA wants to merge 1 commit into from

Conversation

@Schiano-NOAA
Copy link
Collaborator

@Schiano-NOAA Schiano-NOAA commented Oct 17, 2025

What is the feature?

  • New github action that works in tandem with action in stockplotr to update example data

How have you implemented the solution?

  • New workflow for github action to interact with stockplotr

Does the PR impact any other area of the project, maybe another repo?

  • yes, directly interacts with stockplotr -- I am not sure of the repercussions of this action and potential issues.

@k-doering-NOAA if you have any thoughts, advice, or could provide help on this, it would be greatly appreciated!

@github-actions
Copy link
Contributor

github-actions bot commented Oct 17, 2025

Checklist

  • PR base branch is accurate
  • Is the code concise?
  • Comments are clear and useful.
  • Can you remove or combine any arguments?
  • Do argument contain defaults (if appliable)?
  • Code is documented and example provided (Roxygen).
  • Did you make a test (testthat)?
  • Was this tested under multiple scenarios?
  • Did you run devtools::check()?

github-advanced-security[bot]
github-advanced-security bot found potential problems Oct 17, 2025
View reviewed changes
.github/workflows/release-for-stockplotr-update.yml
Comment on lines +12 to +32
runs-on: ubuntu-latest
steps:
- name: Send repository_dispatch to Repository B (stockplotr)
uses: peter-evans/repository-dispatch@v3
with:
# This token is required to talk to the GitHub API.
# It must be a PAT stored in Repo A's secrets with 'repo' scope.
token: ${{ secrets.REPO_B_PAT }}

# The target repository where the action will run
repository: 'nmfs-ost/stockplotr'

# This is the event name that Repo B's workflow will listen for.
event-type: 'release_trigger'

# Pass data needed by Repo B in the client-payload
client-payload: |
{
"release_tag": "${{ github.event.release.tag_name }}",
"repository_a_name": "${{ github.repository }}"
}

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {}

Copilot Autofix

AI 3 months ago

The best way to fix the problem is to set an explicit permissions block in the workflow YAML, limiting the GITHUB_TOKEN to only the access needed for this workflow. Because the workflow mainly sends a repository dispatch (using a PAT—not GITHUB_TOKEN), and does not need to write code, releases, or issues, the minimum permission should be set to contents: read—GitHub’s recommended baseline. The permissions block should be added at the root of the workflow (just after name: or before/on top of jobs:) so it is inherited by all jobs, unless jobs need elevated permissions (which is not the case here).

Edit .github/workflows/release-for-stockplotr-update.yml:

  • Insert the following block: 
    permissions:
  contents: read
    Place it after the name: at line 4, before on: at line 5.
    No new imports, variables, or dependencies are needed.
Suggested changeset 1
.github/workflows/release-for-stockplotr-update.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/release-for-stockplotr-update.yml b/.github/workflows/release-for-stockplotr-update.yml
--- a/.github/workflows/release-for-stockplotr-update.yml
+++ b/.github/workflows/release-for-stockplotr-update.yml
@@ -1,6 +1,8 @@
 # This workflow lives in Repository A (the one with the new release)
 
 name: 1. Dispatch Release to Repo B
+permissions:
+  contents: read
 
 on:
   release:
EOF
@@ -1,6 +1,8 @@
# This workflow lives in Repository A (the one with the new release)

name: 1. Dispatch Release to Repo B
permissions:
contents: read

on:
release:
Copilot is powered by AI and may make mistakes. Always verify output.
.github/workflows/release-for-stockplotr-update.yml
runs-on: ubuntu-latest
steps:
- name: Send repository_dispatch to Repository B (stockplotr)
uses: peter-evans/repository-dispatch@v3

Check warning

Code scanning / CodeQL

Unpinned tag for a non-immutable Action in workflow Medium

Unpinned 3rd party Action '1. Dispatch Release to Repo B' step
Uses Step
Loading
uses 'peter-evans/repository-dispatch' with ref 'v3', not a pinned commit hash
@Schiano-NOAA Schiano-NOAA marked this pull request as draft October 17, 2025 18:31
@github-actions
Copy link
Contributor

github-actions bot commented Oct 17, 2025

Code Metrics Report

Coverage Code to Test Ratio Test Execution Time
48.1% 1:0.1 4m39s

Reported by octocov

@Schiano-NOAA
Copy link
Collaborator Author

Schiano-NOAA commented Nov 17, 2025

@e-perl-NOAA this is the PR that's linked to the other

@k-doering-NOAA k-doering-NOAA mentioned this pull request Nov 19, 2025
Draft
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@Schiano-NOAA