ci: release automation, and repair the CHANGELOG it will gate on #25
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change | ||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| @@ -0,0 +1,83 @@ | ||||||||||||||||||||||||||||||||||||||
| name: Release | ||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||
| on: | ||||||||||||||||||||||||||||||||||||||
| push: | ||||||||||||||||||||||||||||||||||||||
| tags: | ||||||||||||||||||||||||||||||||||||||
| - "v*" | ||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||
| permissions: | ||||||||||||||||||||||||||||||||||||||
| contents: write | ||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||
| jobs: | ||||||||||||||||||||||||||||||||||||||
| release: | ||||||||||||||||||||||||||||||||||||||
| name: Tag → GitHub Release → proxy.golang.org | ||||||||||||||||||||||||||||||||||||||
| runs-on: ubuntu-latest | ||||||||||||||||||||||||||||||||||||||
| steps: | ||||||||||||||||||||||||||||||||||||||
| - uses: actions/checkout@v4 | ||||||||||||||||||||||||||||||||||||||
| with: | ||||||||||||||||||||||||||||||||||||||
| fetch-depth: 0 | ||||||||||||||||||||||||||||||||||||||
|
Comment on lines
+16
to
+18
There was a problem hiding this comment. 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- release workflow ---'
cat -n .github/workflows/release.yml
printf '%s\n' '--- workflow files ---'
git ls-files '.github/workflows/*'
printf '%s\n' '--- action invocations ---'
rg -n --glob '.github/workflows/**' '^\s*-?\s*uses:|persist-credentials|GITHUB_TOKEN|token:' .Repository: hallelx2/pdftable Length of output: 3542 🏁 Script executed: #!/bin/bash
set -eu
python3 - <<'PY'
import json
import urllib.request
def get(url):
req = urllib.request.Request(url, headers={"Accept": "application/vnd.github+json", "User-Agent": "review-verifier"})
with urllib.request.urlopen(req, timeout=20) as r:
return json.load(r)
for repo, tag in [
("actions/checkout", "v4"),
("actions/setup-go", "v5"),
("softprops/action-gh-release", "v2"),
]:
print(f"--- {repo}@{tag} ref ---")
ref = get(f"https://api.github.com/repos/{repo}/git/ref/tags/{tag}")
print(json.dumps({
"ref": ref.get("ref"),
"object_type": ref.get("object", {}).get("type"),
"object_sha": ref.get("object", {}).get("sha"),
}, indent=2))
obj = ref.get("object", {})
if obj.get("type") == "tag":
tagobj = get(f"https://api.github.com/repos/{repo}/git/tags/{obj['sha']}")
print(json.dumps({
"dereferenced_type": tagobj.get("object", {}).get("type"),
"dereferenced_sha": tagobj.get("object", {}).get("sha"),
}, indent=2))
print(f"--- {repo}@{tag} action metadata ---")
for path in (".github/actions/checkout/action.yml", "action.yml"):
try:
raw = urllib.request.urlopen(
urllib.request.Request(
f"https://raw.githubusercontent.com/{repo}/{tag}/{path}",
headers={"User-Agent": "review-verifier"},
),
timeout=20,
).read().decode()
if path == "action.yml":
print(raw[:12000])
break
except Exception:
pass
PYRepository: hallelx2/pdftable Length of output: 2507 🌐 Web query:
💡 Result: For the Citations:
Pin workflow actions and disable checkout credential persistence. Because this workflow grants 🧰 Tools🪛 zizmor (1.29.0)[warning] 16-18: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false (artipacked) 🤖 Prompt for AI AgentsSource: Linters/SAST tools |
||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||
| - name: Set up Go | ||||||||||||||||||||||||||||||||||||||
| uses: actions/setup-go@v5 | ||||||||||||||||||||||||||||||||||||||
| with: | ||||||||||||||||||||||||||||||||||||||
| go-version: "1.25" | ||||||||||||||||||||||||||||||||||||||
| cache: true | ||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||
| - name: Validate tag is semver | ||||||||||||||||||||||||||||||||||||||
| run: | | ||||||||||||||||||||||||||||||||||||||
| tag="${GITHUB_REF_NAME}" | ||||||||||||||||||||||||||||||||||||||
| if [[ ! "$tag" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?(\+[0-9A-Za-z.-]+)?$ ]]; then | ||||||||||||||||||||||||||||||||||||||
| echo "::error::tag '$tag' is not a valid Go-module semver (vX.Y.Z[-pre][+meta])" | ||||||||||||||||||||||||||||||||||||||
| exit 1 | ||||||||||||||||||||||||||||||||||||||
| fi | ||||||||||||||||||||||||||||||||||||||
| echo "tag $tag accepted" | ||||||||||||||||||||||||||||||||||||||
|
Comment on lines
+26
to
+33
There was a problem hiding this comment. 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- workflow excerpt ---'
sed -n '1,55p' .github/workflows/release.yml
printf '%s\n' '--- repository semver-related references ---'
rg -n --hidden -g '!node_modules' -g '!dist' -g '!build' \
'x/mod/semver|semver|Validate tag|GITHUB_REF_NAME' .github go.mod go.sum 2>/dev/null || true
printf '%s\n' '--- regex behavior for the cited tags ---'
python3 - <<'PY'
import re
pattern = re.compile(r'^v[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?(\+[0-9A-Za-z.-]+)?$')
for tag in [
"v01.2.3",
"v1.2.3-01",
"v1.2.3-rc..1",
"v1.2.3",
"v1.2.3-rc.1",
"v1.2.3+build.1",
]:
print(f"{tag}: {'accepted' if pattern.fullmatch(tag) else 'rejected'}")
PYRepository: hallelx2/pdftable Length of output: 2301 🌐 Web query:
💡 Result: The golang.org/x/mod/semver package implements semantic versioning with specific rules and behaviors described in its documentation and source code [1][2]. Leading Zeros Major, minor, and patch components must be decimal integers without extra leading zeros (e.g., "v01.0.0" is invalid) [2]. Regarding pre-release identifiers, the package follows the Semantic Versioning 2.0.0 specification, which dictates that numeric pre-release identifiers must not include leading zeros [2][3][4]. The package enforces this through parsing logic that rejects numeric identifiers with leading zeros [3]. Prerelease and Empty Identifiers A semantic version string accepted by this package follows the form vMAJOR[.MINOR[.PATCH[-PRERELEASE][+BUILD]]] [2]. - Prerelease: A pre-release string starts with a hyphen [5][2]. It consists of a series of dot-separated identifiers [2]. - Empty Identifiers: The package follows the rule that pre-release and build metadata identifiers must not be empty [2][3][4]. The internal parsing functions (such as parsePrerelease and parseBuild) explicitly check for empty identifiers between dots or surrounding hyphens/plus signs and will return an invalid status if they are found [3]. The package maintains strict adherence to these rules to ensure compatibility within the Go module ecosystem [2]. While it generally follows SemVer 2.0.0, it includes two specific deviations: it mandates a leading "v" prefix (e.g., "v1.0.0"), and it supports vMAJOR and vMAJOR.MINOR as shorthand for vMAJOR.0.0 and vMAJOR.MINOR.0, respectively [2]. Citations:
Reject invalid Go module version tags. The regex accepts invalid tags such as 🤖 Prompt for AI Agents |
||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||
| - name: Verify the tag has a CHANGELOG entry | ||||||||||||||||||||||||||||||||||||||
| # A release with no changelog section is how v0.4.0 shipped | ||||||||||||||||||||||||||||||||||||||
| # undocumented. Fail the release rather than discover it later. | ||||||||||||||||||||||||||||||||||||||
| run: | | ||||||||||||||||||||||||||||||||||||||
| version="${GITHUB_REF_NAME#v}" | ||||||||||||||||||||||||||||||||||||||
| if ! grep -q "^## \[${version}\]" CHANGELOG.md; then | ||||||||||||||||||||||||||||||||||||||
| echo "::error::CHANGELOG.md has no '## [${version}]' section" | ||||||||||||||||||||||||||||||||||||||
| exit 1 | ||||||||||||||||||||||||||||||||||||||
| fi | ||||||||||||||||||||||||||||||||||||||
| echo "changelog entry for ${version} found" | ||||||||||||||||||||||||||||||||||||||
|
Comment on lines
+35
to
+44
There was a problem hiding this comment. 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- workflow context ---'
sed -n '1,90p' .github/workflows/release.yml
printf '%s\n' '--- changelog headings ---'
rg -n '^## ' CHANGELOG.md | head -80
printf '%s\n' '--- related release references ---'
rg -n 'GITHUB_REF_NAME|CHANGELOG|release.yml' .github README.md CHANGELOG.md 2>/dev/null | head -120
printf '%s\n' '--- grep behavior for representative versions ---'
python3 - <<'PY'
import subprocess
from pathlib import Path
import tempfile
pattern = r'^## \[${version}\]'
samples = [
("1.2.3", "## [1x2y3]"),
("1.2.3", "## [1.2.3]"),
("1.2.3", "## [1.2.30]"),
("1.2.3", "## [1.2.3-extra]"),
("1[2].3", "## [1[2].3]"),
]
for version, line in samples:
with tempfile.NamedTemporaryFile("w+", delete=False) as f:
f.write(line + "\n")
name = f.name
shell_pattern = pattern.replace("${version}", version)
result = subprocess.run(
["grep", "-q", shell_pattern, name],
stdout=subprocess.DEVNULL,
stderr=subprocess.DEVNULL,
)
print(f"version={version!r} line={line!r} pattern={shell_pattern!r} matched={result.returncode == 0}")
Path(name).unlink()
PYRepository: hallelx2/pdftable Length of output: 4232 Match the changelog heading literally. The dots in 🤖 Prompt for AI Agents |
||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||
| - name: Verify tidy | ||||||||||||||||||||||||||||||||||||||
| run: | | ||||||||||||||||||||||||||||||||||||||
| go mod tidy | ||||||||||||||||||||||||||||||||||||||
| git diff --exit-code -- go.mod go.sum | ||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||
| - name: Vet + build + test | ||||||||||||||||||||||||||||||||||||||
| run: | | ||||||||||||||||||||||||||||||||||||||
| test -z "$(gofmt -l .)" || { echo "::error::gofmt drift"; gofmt -l .; exit 1; } | ||||||||||||||||||||||||||||||||||||||
| go vet ./... | ||||||||||||||||||||||||||||||||||||||
| go build ./... | ||||||||||||||||||||||||||||||||||||||
| go test -race -count=1 -timeout=10m ./... | ||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||
| - name: Create GitHub release | ||||||||||||||||||||||||||||||||||||||
| uses: softprops/action-gh-release@v2 | ||||||||||||||||||||||||||||||||||||||
| with: | ||||||||||||||||||||||||||||||||||||||
| generate_release_notes: true | ||||||||||||||||||||||||||||||||||||||
| name: ${{ github.ref_name }} | ||||||||||||||||||||||||||||||||||||||
| tag_name: ${{ github.ref_name }} | ||||||||||||||||||||||||||||||||||||||
| body: | | ||||||||||||||||||||||||||||||||||||||
| Install: | ||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||
| ```bash | ||||||||||||||||||||||||||||||||||||||
| go get github.com/${{ github.repository }}@${{ github.ref_name }} | ||||||||||||||||||||||||||||||||||||||
| ``` | ||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||
| See [CHANGELOG.md](https://github.com/${{ github.repository }}/blob/${{ github.ref_name }}/CHANGELOG.md) | ||||||||||||||||||||||||||||||||||||||
| for the curated notes. Commit-level changelog auto-generated below. | ||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||
| - name: Warm proxy.golang.org | ||||||||||||||||||||||||||||||||||||||
| # Pull the module through the proxy so pkg.go.dev indexes this version | ||||||||||||||||||||||||||||||||||||||
| # immediately instead of waiting for the next scan. | ||||||||||||||||||||||||||||||||||||||
| run: | | ||||||||||||||||||||||||||||||||||||||
| module=$(go list -m) | ||||||||||||||||||||||||||||||||||||||
| tag="${GITHUB_REF_NAME}" | ||||||||||||||||||||||||||||||||||||||
| echo "warming proxy for $module@$tag" | ||||||||||||||||||||||||||||||||||||||
| curl -fsSL "https://proxy.golang.org/${module}/@v/${tag}.info" || true | ||||||||||||||||||||||||||||||||||||||
| curl -fsSL "https://proxy.golang.org/${module}/@v/${tag}.mod" || true | ||||||||||||||||||||||||||||||||||||||
|
Comment on lines
+74
to
+82
There was a problem hiding this comment. suggestion (bug_risk): Suppressing curl failures completely may hide useful diagnostics if proxy warming fails All three |
||||||||||||||||||||||||||||||||||||||
| curl -fsSL "https://sum.golang.org/lookup/${module}@${tag}" || true | ||||||||||||||||||||||||||||||||||||||
|
Comment on lines
+74
to
+83
There was a problem hiding this comment. 🗄️ Data Integrity & Integration | 🟡 Minor | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -e
printf '%s\n' '--- workflow ---'
cat -n .github/workflows/release.yml | sed -n '1,120p'
printf '%s\n' '--- module declarations ---'
git ls-files | rg '(^|/)(go\.mod|go\.work|release\.yml)$' || true
for f in $(git ls-files | rg '(^|/)go\.mod$' || true); do
printf '%s\n' "--- $f ---"
cat -n "$f" | sed -n '1,80p'
done
printf '%s\n' '--- relevant workflow and release references ---'
rg -n --hidden -g '!node_modules' -g '!dist' 'proxy\.golang\.org|sum\.golang\.org|go mod download|GITHUB_REF_NAME|go list -m|pkg\.go\.dev' .github README.md go.mod 2>/dev/null || trueRepository: hallelx2/pdftable Length of output: 6364 🌐 Web query:
💡 Result: The Go module proxy protocol is a simple, stateless HTTP-based API that allows the go command to retrieve module information and source code from servers called module proxies [1][2]. Proxies serve content via GET requests to specific endpoints, meaning they can be implemented as simple web servers or even static file systems [1][2]. The standard endpoints defined by the protocol are: - /{module}/@v/list: Returns a list of all known versions for a module, one per line [2]. - /{module}/@v/{version}.info: Returns a JSON-encoded file containing metadata about the module version, such as the exact version string and timestamp [3][4]. - /{module}/@v/{version}.mod: Returns the content of the module's go.mod file [3][2]. If the original module lacks a go.mod file, the proxy is expected to provide a synthetic one [5][6]. - /{module}/@v/{version}.zip: Returns the module source code as a ZIP archive [3][4]. Each file in the zip must be prefixed with the module path and version (e.g., example.com/mod@v1.0.0/) [2]. The Go command uses the GOPROXY environment variable to determine which proxies to contact [5][6]. When resolving a module, it checks the defined proxies in order; if a requested file returns a 404 or 410, it typically moves to the next configured proxy [5][6]. Regarding indexing and pkg.go.dev: - Indexing: The service index.golang.org maintains a public feed of new module versions that become available on proxy.golang.org [7][8]. - Discovery: Pkg.go.dev monitors this index to discover new modules [9][10]. A worker process consumes these updates, downloads the corresponding module source code from proxy.golang.org using the module proxy protocol, and processes it to extract documentation, licenses, and other metadata for the website [9][10]. - User Requests: If a module is not yet indexed, users can trigger discovery by visiting the module's page on pkg.go.dev and clicking a "Request" button, which initiates the process [10]. In summary, the protocol provides a standardized, efficient way to distribute Go modules, while pkg.go.dev leverages the index service and proxy mirror to automate the discovery and documentation of the Go ecosystem [7][9][10]. Citations:
🏁 Script executed: #!/bin/bash
set -u
printf '%s\n' '--- tags ---'
git tag --list 'v*' --sort=-version:refname | head -20
printf '%s\n' '--- go command availability and help ---'
if command -v go >/dev/null 2>&1; then
go version
go help mod download | sed -n '1,180p'
else
echo 'go not available'
fi
printf '%s\n' '--- proxy endpoint status for latest local tag ---'
tag=$(git tag --list 'v*' --sort=-version:refname | head -1)
module=$(sed -n 's/^module[[:space:]]\\+//p' go.mod | head -1)
if [ -n "$tag" ] && [ -n "$module" ]; then
for suffix in info mod zip; do
url="https://proxy.golang.org/${module}/@v/${tag}.${suffix}"
printf '%s ' "$url"
curl -sS -L -o /dev/null -w 'HTTP %{http_code}, final=%{url_effective}\n' "$url" || true
done
url="https://sum.golang.org/lookup/${module}@${tag}"
printf '%s ' "$url"
curl -sS -L -o /dev/null -w 'HTTP %{http_code}, final=%{url_effective}\n' "$url" || true
fiRepository: hallelx2/pdftable Length of output: 2733 🌐 Web query:
💡 Result: The Go module proxy protocol defines a specific URL structure for downloading module source code as a zip archive. To download a specific version of a module from a proxy server (such as proxy.golang.org), you can perform an HTTP GET request to the following endpoint: //@v/.zip In this URL pattern: - is the module path (often with characters escaped if they contain uppercase letters). - is the semantic version of the module. For example, to download version v1.0.0 of a module named example.com/my/mod, the request URL would be: https://proxy.golang.org/example.com/my/mod/@v/v1.0.0.zip The module proxy protocol also supports other endpoints for retrieving information, such as: - //@v/.info: Returns JSON metadata about the version. - //@v/.mod: Returns the go.mod file for that version. - //@latest: Returns the latest version of the module. When using these endpoints, note that the Go command-line tool manages these interactions automatically based on the GOPROXY environment variable [1]. If you are interacting with the proxy manually, ensure that any uppercase letters in the module path are replaced with their lowercase equivalent preceded by an exclamation mark (e.g., example.com/User/Mod becomes example.com/!user/!mod). [1] Citations: 🏁 Script executed: #!/bin/bash
set -u
printf '%s\n' '--- repository remotes ---'
git remote -v || true
printf '%s\n' '--- GitHub tags ---'
curl -fsSL 'https://api.github.com/repos/hallelx2/pdftable/tags?per_page=20' |
jq -r '.[] | [.name, .commit.sha] | `@tsv`' || true
printf '%s\n' '--- go mod download implementation references ---'
if command -v go >/dev/null 2>&1; then
goroot=$(go env GOROOT)
rg -n -C 5 'download.*error|modDownload|Download.*Error|Error.*download|return.*Error' \
"$goroot/src/cmd/go/internal/modcmd" "$goroot/src/cmd/go/internal/modload" \
"$goroot/src/cmd/go/internal/modfetch" 2>/dev/null |
head -240 || true
fi
printf '%s\n' '--- module proxy reference text ---'
if command -v go >/dev/null 2>&1; then
goroot=$(go env GOROOT)
rg -n -C 3 'zip.*source|\.zip|proxy protocol|mod\.go\.dev|index\.golang\.org' \
"$goroot/src/cmd/go" 2>/dev/null | head -220 || true
fiRepository: hallelx2/pdftable Length of output: 41516 🌐 Web query:
💡 Result: When running go mod download -json, the Go command provides module information in JSON format for successful operations [1]. If the command encounters an error, it exits with a non-zero status code [1]. In Go, when a command fails, it reports an error message to standard error (stderr). If you are using the -json flag, the command is intended to output structured information; however, if the command fails, the output may be incomplete, or the error details may be printed to stderr instead of being encapsulated within the JSON stream. Common causes for go mod download failures include: 1. Missing or inconsistent information in go.mod or go.sum files [1]. 2. Network issues or unavailability of modules through configured proxies in GOPROXY [1]. 3. Multiple modules providing the same package, or no modules found for a requested package [1]. To resolve errors, you can typically use the go mod tidy command to update and correct your go.mod and go.sum files [1]. If you encounter specific issues, ensure that your environment's GOPROXY settings are correctly configured to reach the required module repositories [1]. Citations: 🏁 Script executed: #!/bin/bash
set -u
module='github.com/hallelx2/pdftable'
tag='v0.4.0'
printf '%s\n' '--- proxy endpoint status ---'
for suffix in info mod zip; do
url="https://proxy.golang.org/${module}/@v/${tag}.${suffix}"
printf '%s ' "$url"
curl -sS -L -o /dev/null -w 'HTTP %{http_code}, bytes=%{size_download}, final=%{url_effective}\n' "$url" || true
done
url="https://sum.golang.org/lookup/${module}@${tag}"
printf '%s ' "$url"
curl -sS -L -o /dev/null -w 'HTTP %{http_code}, bytes=%{size_download}, final=%{url_effective}\n' "$url" || true
printf '%s\n' '--- download command source ---'
if command -v go >/dev/null 2>&1; then
goroot=$(go env GOROOT)
fd -a 'download\.go$' "$goroot/src/cmd/go/internal/modcmd" "$goroot/src/cmd/go/internal/modfetch" 2>/dev/null |
while read -r f; do
printf '%s\n' "--- $f ---"
rg -n -C 6 'func.*download|Download|Zip|\.zip|Exit|SetExitStatus|Error' "$f" | head -220
done
fiRepository: hallelx2/pdftable Length of output: 8836 🌐 Web query:
💡 Result: The services proxy.golang.org, pkg.go.dev, and index.golang.org play distinct roles in the Go module ecosystem: proxy.golang.org This is an official module proxy server maintained by Google. When the go command needs to download a module, it checks the proxy defined by the GOPROXY environment variable [1]. The proxy acts as a cache and a reliable source for module versions, allowing the go command to download modules without needing direct access to version control systems [1]. pkg.go.dev This is a website that serves as a documentation hub and discovery service for Go packages. It indexes public Go modules and provides documentation, helping developers find and understand available packages. index.golang.org This service provides an index of new modules as they are published to the proxy. It allows services like pkg.go.dev to monitor the proxy for new content, enabling the discovery and indexing of new module versions in real-time. Protocol and Source Files The Go module proxy protocol defines how the go command interacts with proxies. When a module is requested, the proxy serves information and files based on the requested version. Specifically, when a module version is requested, the proxy can provide a.zip file (the source zip) containing the module's source code, which the go command downloads and caches locally [1]. These interactions occur over HTTP, and the go command automatically handles requests for module metadata and source files from the configured proxy [1]. Citations: Fetch the module archive and fail on warm-up errors.
Proposed fix- curl -fsSL "https://proxy.golang.org/${module}/@v/${tag}.info" || true
- curl -fsSL "https://proxy.golang.org/${module}/@v/${tag}.mod" || true
- curl -fsSL "https://sum.golang.org/lookup/${module}@${tag}" || true
+ GOPROXY=proxy.golang.org go mod download -json "$module@$tag"📝 Committable suggestion
Suggested change
🤖 Prompt for AI Agents |
||||||||||||||||||||||||||||||||||||||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift
Limit
contents: writeto the publication job.The validation commands execute with a write-capable
GITHUB_TOKEN. Compromised repository code or tests can use that token before the release is created. Split validation and publication into separate jobs. Set validation tocontents: read; grantcontents: writeonly to the release job. GitHub recommends explicit minimum permissions for workflows. (docs.github.com)🤖 Prompt for AI Agents