Fix GHCR Permissions of GHA Runners#28
Conversation
There was a problem hiding this comment.
Pull request overview
Updates GitHub Actions workflow permissions to ensure GHA runners can pull images from GHCR with least-privilege access, and adjusts the Copilot workflow’s dependency/tool setup.
Changes:
- Add explicit workflow-level
permissions(contents: read,packages: read) to PR and Copilot workflows. - Expand Copilot workflow setup to install dev-group deps and common CLI tools.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| .github/workflows/on_pr.yml | Adds explicit read permissions needed to pull GHCR images during PR test runs. |
| .github/workflows/copilot.yml | Adds explicit read permissions and extends setup steps for a richer dev environment. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
@olivia-banks, I'm not following copilot's review entirely. Ping me when you are ready |
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
FYI, this action will never pass on this PR because publishing to the container registry only happens on merge into Ping @gvegayon |
gvegayon
left a comment
gvegayon
left a comment
There was a problem hiding this comment.
FYI, this action will never pass on this PR because publishing to the container registry only happens on merge into
main.Ping @gvegayon
Alright, but we need to address that later (not today). We can add a conditional if for pushing the container only if running on the default branch. Approving for now!
See title, resolves some comments I forgot about in #20. Very basic PR.