Release v10.5.2#2784
Conversation
Bumps [ASFHyP3/actions](https://github.com/asfhyp3/actions) from 0.19.0 to 0.20.0. - [Release notes](https://github.com/asfhyp3/actions/releases) - [Changelog](https://github.com/ASFHyP3/actions/blob/develop/CHANGELOG.md) - [Commits](ASFHyP3/actions@v0.19.0...v0.20.0) --- updated-dependencies: - dependency-name: ASFHyP3/actions dependency-version: 0.20.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
Group dependabot updates
Bumps the pip-deps group with 7 updates: | Package | From | To | | --- | --- | --- | | [jsonschema](https://github.com/python-jsonschema/jsonschema) | `4.23.0` | `4.24.0` | | [boto3](https://github.com/boto/boto3) | `1.38.19` | `1.38.24` | | [moto[dynamodb]](https://github.com/getmoto/moto) | `5.1.4` | `5.1.5` | | [ruff](https://github.com/astral-sh/ruff) | `0.11.10` | `0.11.11` | | [setuptools](https://github.com/pypa/setuptools) | `80.7.1` | `80.9.0` | | [cfn-lint](https://github.com/aws-cloudformation/cfn-lint) | `1.35.1` | `1.35.3` | | [cryptography](https://github.com/pyca/cryptography) | `45.0.2` | `45.0.3` | Updates `jsonschema` from 4.23.0 to 4.24.0 - [Release notes](https://github.com/python-jsonschema/jsonschema/releases) - [Changelog](https://github.com/python-jsonschema/jsonschema/blob/main/CHANGELOG.rst) - [Commits](python-jsonschema/jsonschema@v4.23.0...v4.24.0) Updates `boto3` from 1.38.19 to 1.38.24 - [Release notes](https://github.com/boto/boto3/releases) - [Commits](boto/boto3@1.38.19...1.38.24) Updates `moto[dynamodb]` from 5.1.4 to 5.1.5 - [Release notes](https://github.com/getmoto/moto/releases) - [Changelog](https://github.com/getmoto/moto/blob/master/CHANGELOG.md) - [Commits](getmoto/moto@5.1.4...5.1.5) Updates `ruff` from 0.11.10 to 0.11.11 - [Release notes](https://github.com/astral-sh/ruff/releases) - [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md) - [Commits](astral-sh/ruff@0.11.10...0.11.11) Updates `setuptools` from 80.7.1 to 80.9.0 - [Release notes](https://github.com/pypa/setuptools/releases) - [Changelog](https://github.com/pypa/setuptools/blob/main/NEWS.rst) - [Commits](pypa/setuptools@v80.7.1...v80.9.0) Updates `cfn-lint` from 1.35.1 to 1.35.3 - [Release notes](https://github.com/aws-cloudformation/cfn-lint/releases) - [Changelog](https://github.com/aws-cloudformation/cfn-lint/blob/main/CHANGELOG.md) - [Commits](aws-cloudformation/cfn-lint@v1.35.1...v1.35.3) Updates `cryptography` from 45.0.2 to 45.0.3 - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@45.0.2...45.0.3) --- updated-dependencies: - dependency-name: jsonschema dependency-version: 4.24.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: pip-deps - dependency-name: boto3 dependency-version: 1.38.24 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: pip-deps - dependency-name: moto[dynamodb] dependency-version: 5.1.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: pip-deps - dependency-name: ruff dependency-version: 0.11.11 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: pip-deps - dependency-name: setuptools dependency-version: 80.9.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: pip-deps - dependency-name: cfn-lint dependency-version: 1.35.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: pip-deps - dependency-name: cryptography dependency-version: 45.0.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: pip-deps ... Signed-off-by: dependabot[bot] <support@github.com>
Bump the pip-deps group with 7 updates
…P3/actions-0.20.0 Bump ASFHyP3/actions from 0.19.0 to 0.20.0
Update deployment docs for EDC
Update opera rtc to use ghcr image
| jobs: | ||
| call-changelog-check-workflow: | ||
| uses: ASFHyP3/actions/.github/workflows/reusable-changelog-check.yml@v0.19.0 | ||
| uses: ASFHyP3/actions/.github/workflows/reusable-changelog-check.yml@v0.20.0 |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 11 months ago
To fix the issue, we need to add a permissions block to the workflow. This block should specify the least privileges required for the workflow to function correctly. Since the workflow is calling a reusable workflow for changelog checks, it likely only needs read access to the repository contents. We will add permissions: contents: read at the root level of the workflow to apply this restriction to all jobs.
| @@ -2,2 +2,5 @@ | ||
|
|
||
| permissions: | ||
| contents: read | ||
|
|
||
| on: |
| jobs: | ||
| call-labeled-pr-check-workflow: | ||
| uses: ASFHyP3/actions/.github/workflows/reusable-labeled-pr-check.yml@v0.19.0 | ||
| uses: ASFHyP3/actions/.github/workflows/reusable-labeled-pr-check.yml@v0.20.0 |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 11 months ago
To fix the issue, add a permissions block to the workflow to explicitly define the least privileges required for the GITHUB_TOKEN. Since the workflow interacts with pull requests (e.g., labeled, unlabeled, synchronized), it likely requires contents: read and pull-requests: write permissions. These permissions should be added at the root level of the workflow to apply to all jobs unless overridden.
| @@ -2,2 +2,6 @@ | ||
|
|
||
| permissions: | ||
| contents: read | ||
| pull-requests: write | ||
|
|
||
| on: |
Developer checklist
Reviewer checklist
|
remove multi-burst-sandbox
No description provided.