chore: Update GitHub Actions workflows to use fallback token and add permissions#42
Merged
sachin-spotdraft merged 1 commit intomainfrom Mar 26, 2026
Merged
chore: Update GitHub Actions workflows to use fallback token and add permissions#42sachin-spotdraft merged 1 commit intomainfrom
sachin-spotdraft merged 1 commit intomainfrom
Conversation
…permissions - Modified workflows to use a fallback for the GitHub token, allowing for better access management. - Added necessary permissions for write access to contents and issues in relevant workflows.
codebreach
approved these changes
Mar 26, 2026
siva-spotdraft
approved these changes
Mar 26, 2026
![baz-reviewer[bot]](https://avatars.githubusercontent.com/in/933528?s=60&v=4){kind=small}
Comment on lines
4
to
15
| autolabeler: | ||
| runs-on: [ubicloud-standard-2] | ||
| name: PR size Workflows | ||
| permissions: | ||
| issues: write | ||
| pull-requests: read | ||
| steps: | ||
| - uses: actions/checkout@v6 | ||
| - uses: codelytv/pr-size-labeler@v1 | ||
| with: | ||
| GITHUB_TOKEN: ${{ secrets.GH_BOT_PAT }} | ||
| GITHUB_TOKEN: ${{ secrets.GH_BOT_PAT || github.token }} | ||
| xs_label: 'size/xs' |
There was a problem hiding this comment.
GITHUB_TOKEN: ${{ secrets.GH_BOT_PAT || github.token }} falls back to read-only github.token on fork PRs and permissions lacks pull-requests: write — should we require the PAT, add pull-requests: write, and guard fork PRs with an if condition?
Finding types: Logical Bugs | Severity: 🔴 High
Want Baz to fix this for you? Activate Fixer
Prompt for AI Agents:
Before applying, verify this suggestion against the current code. In
.github/workflows/pr-labeler.yaml around lines 4-16, the autolabeler job currently falls
back to GITHUB_TOKEN: ${{ secrets.GH_BOT_PAT || github.token }} which is read-only for
forked PRs and the permissions block sets pull-requests: read instead of pull-requests:
write. Change the job to: (1) update the permissions block to include both issues: write
and pull-requests: write so the codelytv/pr-size-labeler action can modify PR labels,
(2) remove the github.token fallback and require GITHUB_TOKEN: ${{ secrets.GH_BOT_PAT }}
or alternatively switch to the pull_request_target event with the PAT, and (3) add an if
condition to the labeling step so it only runs when either the PR is not from a fork
(github.event.pull_request.head.repo.fork == false) or when secrets.GH_BOT_PAT is
present. Optionally add a debug/log step that warns and skips labeling when neither
condition is met.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
User description
Generated description
Below is a concise technical summary of the changes proposed in this PR:
Adjust the cherrypick, create-release, and promote-to-prod workflows to rely on a fallback token and explicit contents permissions so the tag and checkout steps keep working when the bot PAT is unavailable. Ensure the labeler, remove-labels, and stale jobs request issues/pull-requests permissions and mirror that fallback so automation can run without the dedicated secret.
github.tokenfor checkout and tagging, keeping tag pushes stable even whenGH_BOT_PATis unavailable.Modified files (3)
Latest Contributors(1)
github.tokenfallback so labeling automation keeps working without the bot PAT.Modified files (3)
Latest Contributors(1)