From 3ba9be1b494c0bac1f0b457b534bbf04042a7273 Mon Sep 17 00:00:00 2001 From: Mahdi Shafiei Date: Wed, 28 Oct 2026 21:15:20 -0700 Subject: [PATCH] ci: pin already-tested to substrax a61235a and grant the reads it makes The already_tested job pins substrax a61235a. Its action reads only check results through its own query, and reads a pull request with no check as unproven, which the action at ec43d80 counted as proven. The job now names the contents, pull-requests, checks and statuses read the action makes: a public repository's token reads them anyway, and the grants keep the job working if the repository turns private. --- .github/workflows/ci.yml | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 29a8653..83d9e2c 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -18,6 +18,13 @@ jobs: already_tested: name: Tree already tested runs-on: ubuntu-latest + # The action reads the merged pull request and its checks; a private repository's token + # reads them only with these, and naming them keeps a public one working if it turns private. + permissions: + contents: read + pull-requests: read + checks: read + statuses: read outputs: skip: ${{ steps.compare.outputs.skip }} steps: @@ -30,7 +37,7 @@ jobs: - name: Compare this tree with the pull request that produced it id: compare if: github.event_name == 'push' - uses: avitai/substrax/.github/actions/already-tested@ec43d80bbae0040375f746cd1bb07dddb0a0b169 + uses: avitai/substrax/.github/actions/already-tested@a61235ad7f851081efca508285b660a9d7f921ea quality: name: Quality Gate