Conversation
Semver Impact of This PR⚪ None (no version bump detected) 📋 Changelog PreviewThis is how your changes will appear in the changelog. New Features ✨Langchain
Internal Changes 🔧Langchain
Other
Other
🤖 This preview updates automatically when you update the PR. |
| pull_request_target: | ||
| types: [opened] | ||
|
|
||
| jobs: | ||
| close-if-issue-assigned: | ||
| runs-on: ubuntu-latest | ||
| timeout-minutes: 5 |
There was a problem hiding this comment.
Missing explicit permissions on pull_request_target workflow
The workflow uses pull_request_target trigger but doesn't specify explicit permissions. With pull_request_target, the workflow runs with the permissions of the base repository, not the fork. Without explicit permission restrictions, this workflow may have broader access than needed (e.g., contents: write, packages: write, etc.). While this specific workflow only needs pull-requests: write and issues: read, it may inherit broader default permissions.
Verification
Verified by reading the workflow file which shows no permissions: block. Compared to changelog-preview.yml in the same repo which does specify explicit permissions for its pull_request_target workflow. The GitHub documentation recommends always specifying minimal permissions for pull_request_target workflows.
Suggested fix: Add explicit permissions to limit the workflow's access to only what's needed
| pull_request_target: | |
| types: [opened] | |
| jobs: | |
| close-if-issue-assigned: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| permissions: | |
| pull-requests: write | |
| issues: read |
Identified by Warden code-review · GZP-9D3
Codecov Results 📊✅ 13 passed | Total: 13 | Pass Rate: 100% | Execution Time: 10.29s All tests are passing successfully. ✅ Patch coverage is 100.00%. Project has 14386 uncovered lines. Generated by Codecov Action |
Description
Issues
Reminders
tox -e linters.feat:,fix:,ref:,meta:)