Repository navigation
fix(managed-files-guard): explain the pull-requests read grant inline - #816
Merged
Merged
Conversation
zizmor 1.30.1's pedantic undocumented-permissions audit flags the uncommented `pull-requests: read` grant in both caller templates, which failed the ci-runner v0.1.35 release gate. A same-line comment names why check-managed-files needs it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Q6B1MWhz73WFRYyyrKjtjY
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
claude-security-review reviewed No security issues found. The PR only adds an inline YAML comment to the existing |
|
claude-review reviewed No findings. The PR adds a same-line comment to
|
kyle-sexton
added a commit
to melodic-software/ci-runner
that referenced
this pull request
Oct 20, 2026
No related issue: release v0.1.35 failed pedantic zizmor (run 39374988850) ## Summary `v0.1.35` ([run 39374988850](https://github.com/melodic-software/ci-runner/actions/runs/39374988850)) failed `Audit workflow security`: zizmor 1.30.1 `--persona pedantic` reports `undocumented-permissions` on `pr-check-managed-files-hosted.yml:85` (`pull-requests: read` with no comment). That file is sync-managed from melodic-software/standards, so as with `v0.1.25` the fix lands upstream: [melodic-software/standards#816](melodic-software/standards#816), then the next standards sync PR here. ## Fix - `docs/releases.md`: record `v0.1.35` as reserved, no release assets. - No local edit to the managed caller; the managed-files guard would reject it. **Release order:** merge standards#816, merge the resulting `chore: sync standards components` PR here, then tag `v0.1.36` from that `main` commit. Tagging before the sync lands repeats the failure. ## Verification Every step of `release-publish-image.yml` job `Verify exact tagged source`, run locally against this branch head (`d9f7380`) with Go 1.27.2, Node 24.21.0, PowerShell 7.6.7: | Step | Command | Result | |---|---|---| | Release version and main ancestry | `git merge-base --is-ancestor HEAD origin/main` | n/a before merge (exits 1: the branch head is not on `main` yet); the tag regex is checked at tag time | | Immutable pins | `pwsh ./scripts/Test-ReleasePins.ps1` | pass | | Dependency freshness | `GITHUB_TOKEN=$(gh auth token) ./scripts/Test-DependencyFreshness.ps1 -OutputPath …` | pass (`hardFail=False`) | | Module graph | `go mod tidy -diff`; `go mod verify` | pass | | Vet | `go vet ./...` | pass | | Tests | `go test ./...` | pass | | Race | `go test -race ./...` | pass | | govulncheck | `go run golang.org/x/vuln/cmd/govulncheck@v1.8.0 ./...` | pass | | Workflow scripts | `node --test .github/scripts/*.test.cjs` | pass | | actionlint + shellcheck | `go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.12 -color -ignore 'unexpected key "queue" for "concurrency" section'` | pass | | zizmor (branch head) | pinned `ghcr.io/zizmorcore/zizmor:1.30.1@sha256:a2eb396d…`, `--persona pedantic`, online, over `.` | **fail**: 1 `undocumented-permissions` (expected until the sync lands) | | zizmor (post-sync simulation) | same, over this tree with standards#816's template at `.github/workflows/pr-check-managed-files-hosted.yml` | pass, no findings | | Worker image build | `docker buildx build --load` (local default builder, not the pinned BuildKit v0.34.0 builder) | pass | | Worker image contract | `./scripts/verify-worker-image.sh ci-runner-worker:release-verification` | pass | | Windows compilation | `GOOS=windows GOARCH=amd64 CGO_ENABLED=0 go build -trimpath` for `ci-runner` and `ci-runner-controller` (`-H=windowsgui`) | pass | Not reproduced locally: the checksum-verified Buildx install and the pinned BuildKit builder setup (the image was built with the local Docker builder). ## Related - [melodic-software/standards#816](melodic-software/standards#816): the upstream fix. - #387, #388: the same path for `v0.1.25`. - #484: the `v0.1.34` freshness fix. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01Q6B1MWhz73WFRYyyrKjtjY Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No related issue: ci-runner release v0.1.35 failed pedantic zizmor on this synced caller (run 39374988850).
Summary
ci-runner's release gate runs zizmor 1.30.1 with
persona: pedantic. Itsundocumented-permissionsaudit flags the uncommentedpull-requests: readgrant (added in #738) in the syncedpr-check-managed-files-hosted.yml, and the release fails. ci-runner cannot edit the managed copy, so the fix lands here, the same path #601 took for v0.1.25.Fix
components/managed-files-guard/managed-files-guard.ymlandmanaged-files-guard-fleet.yml: same-line comment onpull-requests: readnaming why check-managed-files needs it. No permission change.Verification
bash harness/shell/run-tests.sh components/managed-files-guard/managed-files-guard.test.sh: 1 passed (175 PASS, 0 FAIL; covers per-target materialization, byte equality and actionlint on synced output).ghcr.io/zizmorcore/zizmor@sha256:a2eb396d…),--persona pedantic, online, on both templates: no findings..github/workflows/pr-check-managed-files-hosted.yml: no findings (the unmodified tree reports the oneundocumented-permissionsfinding).actionlinton both templates: clean.Related
pull-requests: readgrant.🤖 Generated with Claude Code
https://claude.ai/code/session_01Q6B1MWhz73WFRYyyrKjtjY