Skip to content

Fix the workflows #427

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Sep 9, 2025
Merged

Fix the workflows #427

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 0 additions & 3 deletions .github/dependabot-auto-merge.yml
View file
Open in desktop

This file was deleted.

12 changes: 0 additions & 12 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,18 +9,6 @@ on:

workflow_dispatch:

Comment on lines 9 to 11
Copy link
Contributor

@amazon-q-developer amazon-q-developer bot Sep 9, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛑 Security Risk: Removing the permissions block from the CI workflow removes the principle of least privilege. GitHub Actions workflows should explicitly define minimum required permissions1.

Suggested change
workflow_dispatch:
permissions:
actions: read
checks: write
contents: read
pull-requests: write
security-events: write
statuses: write
jobs:

Footnotes

  1. CWE-250: Execution with Unnecessary Privileges - https://cwe.mitre.org/data/definitions/250.html ↩

permissions:
actions: read
checks: write
contents: none
deployments: none
issues: none
packages: none
pull-requests: write
repository-projects: none
security-events: write
statuses: write

jobs:

build-client:
Expand Down
33 changes: 14 additions & 19 deletions .github/workflows/dependabot-auto-merge.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,29 +1,24 @@
name: dependabot-auto-merge
name: auto-merge
Copy link
Contributor

@amazon-q-developer amazon-q-developer bot Sep 9, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Consider keeping the workflow name as 'dependabot-auto-merge' since it more specifically describes its primary purpose of handling Dependabot PRs.


on:
pull_request_target:
on: pull_request
Copy link
Contributor

@amazon-q-developer amazon-q-developer bot Sep 9, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛑 Security Risk: Changing from pull_request_target to pull_request for Dependabot automation could expose secrets to malicious code in PRs1. The pull_request_target event is specifically designed for secure handling of external contributions.

Footnotes

  1. CWE-522: Insufficiently Protected Credentials - https://cwe.mitre.org/data/definitions/522.html ↩


permissions:
contents: write
pull-requests: write

jobs:
auto-merge:
runs-on: ubuntu-latest

if: github.actor == 'dependabot[bot]'
if: github.event.pull_request.draft == false

Copy link
Contributor

@amazon-q-developer amazon-q-developer bot Sep 9, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The condition github.actor == 'dependabot[bot]' was a crucial security check that should be retained to ensure only Dependabot PRs are auto-merged.

steps:
- uses: actions/checkout@v5

- uses: ahmadnassri/action-dependabot-auto-merge@v2
with:
github-token: ${{ secrets.PERSONAL_TOKEN_FOR_GITHUB_ACTIONS }}
config: .github/dependabot-auto-merge.yml

- name: Slack Notification (not success)
uses: lazy-actions/slatify@master
if: "! success()"
continue-on-error: true
with:
job_name: '*auto-merge*'
type: ${{ job.status }}
icon_emoji: ":octocat:"
url: ${{ secrets.SLACK_WEBHOOK }}
token: ${{ secrets.PERSONAL_TOKEN_FOR_GITHUB_ACTIONS }}
- name: Enable auto-merge for Pull Request
run: |
gh pr review --approve "$PR_URL"
gh pr merge --auto --squash "$PR_URL"
env:
PR_URL: ${{github.event.pull_request.html_url}}
GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
Copy link
Contributor

@amazon-q-developer amazon-q-developer bot Sep 9, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Consider retaining the Slack notification for failed auto-merges as it provides valuable monitoring capabilities for the automation process.