Skip to content

Commit b7db43b

Browse files
WilliamBerryiiiBill Berrykatriendg
authored
fix(workflows): add job-level permissions to validate-version in extension-publish-prerelease (#731)
Added an explicit empty `permissions: {}` block to the `validate-version` job in *.github/workflows/extension-publish-prerelease.yml*. This resolves OpenSSF Scorecard Token-Permissions alerts that flagged the job for missing job-level permissions. The `validate-version` job performs pure shell computation for version string validation and does not require repository content access or elevated token permissions. The `package` and `publish` jobs already had explicit job-level permissions and required no changes. ## Related Issue(s) Fixes #524 Related to #456, #460 ## Type of Change Select all that apply: **Code & Documentation:** - [x] Bug fix (non-breaking change fixing an issue) - [ ] New feature (non-breaking change adding functionality) - [ ] Breaking change (fix or feature causing existing functionality to change) - [ ] Documentation update **Infrastructure & Configuration:** - [x] GitHub Actions workflow - [ ] Linting configuration (markdown, PowerShell, etc.) - [x] Security configuration - [ ] DevContainer configuration - [ ] Dependency update **AI Artifacts:** - [ ] Reviewed contribution with `prompt-builder` agent and addressed all feedback - [ ] Copilot instructions (`.github/instructions/*.instructions.md`) - [ ] Copilot prompt (`.github/prompts/*.prompt.md`) - [ ] Copilot agent (`.github/agents/*.agent.md`) - [ ] Copilot skill (`.github/skills/*/SKILL.md`) > **Note for AI Artifact Contributors**: > > - **Agents**: Research, indexing/referencing other project (using standard VS Code GitHub Copilot/MCP tools), planning, and general implementation agents likely already exist. Review `.github/agents/` before creating new ones. > - **Skills**: Must include both bash and PowerShell scripts. See [Skills](../docs/contributing/skills.md). > - **Model Versions**: Only contributions targeting the **latest Anthropic and OpenAI models** will be accepted. Older model versions (e.g., GPT-3.5, Claude 3) will be rejected. > - See [Agents Not Accepted](../docs/contributing/custom-agents.md#agents-not-accepted) and [Model Version Requirements](../docs/contributing/ai-artifacts-common.md#model-version-requirements). **Other:** - [ ] Script/automation (`.ps1`, `.sh`, `.py`) - [ ] Other (please describe): ## Sample Prompts (for AI Artifact Contributions) <!-- If you checked any boxes under "AI Artifacts" above, provide a sample prompt showing how to use your contribution --> <!-- Delete this section if not applicable --> **User Request:** <!-- What natural language request would trigger this agent/prompt/instruction? --> **Execution Flow:** <!-- Step-by-step: what happens when invoked? Include tool usage, decision points --> **Output Artifacts:** <!-- What files/content are created? Show first 10-20 lines as preview --> **Success Indicators:** <!-- How does user know it worked correctly? What validation should they perform? --> For detailed contribution requirements, see: - **Common Standards**: [docs/contributing/ai-artifacts-common.md](../docs/contributing/ai-artifacts-common.md) - Shared standards for XML blocks, markdown quality, RFC 2119, validation, and testing - **Agents**: [docs/contributing/custom-agents.md](../docs/contributing/custom-agents.md) - Agent configurations with tools and behavior patterns - **Prompts**: [docs/contributing/prompts.md](../docs/contributing/prompts.md) - Workflow-specific guidance with template variables - **Instructions**: [docs/contributing/instructions.md](../docs/contributing/instructions.md) - Technology-specific standards with glob patterns - **Skills**: [docs/contributing/skills.md](../docs/contributing/skills.md) - Task execution utilities with cross-platform scripts ## Testing Automated validation commands executed: | Check | Command | Result | |---|---|---| | Markdown linting | `npm run lint:md` | Passed | | Spell checking | `npm run spell-check` | Passed (7 pre-existing issues in unrelated files) | | Frontmatter validation | `npm run lint:frontmatter` | Passed | | Skill structure validation | `npm run validate:skills` | Passed | | Link validation | `npm run lint:md-links` | Passed | | PowerShell analysis | `npm run lint:ps` | Passed | | Plugin freshness | `npm run plugin:generate` | Passed (no changes) | | YAML linting | `npm run lint:yaml` | Passed | **Security analysis:** The change restricts token permissions to the minimum required (none) for the `validate-version` job. No sensitive data exposure, dependency changes, or privilege escalation detected. **Diff-based assessment:** Confirmed `package` and `publish` jobs already declare explicit job-level permissions. Verified that `gh release view` in the `validate-version` job works on public repositories without elevated token permissions. Manual testing was not performed. ## Checklist ### Required Checks - [x] Documentation is updated (if applicable) (N/A — no documentation changes required) - [x] Files follow existing naming conventions - [x] Changes are backwards compatible (if applicable) - [ ] Tests added for new functionality (if applicable) (N/A — no new functionality) ### AI Artifact Contributions <!-- If contributing an agent, prompt, instruction, or skill, complete these checks --> - [ ] Used `/prompt-analyze` to review contribution - [ ] Addressed all feedback from `prompt-builder` review - [ ] Verified contribution follows common standards and type-specific requirements ### Required Automated Checks The following validation commands must pass before merging: - [x] Markdown linting: `npm run lint:md` - [x] Spell checking: `npm run spell-check` - [x] Frontmatter validation: `npm run lint:frontmatter` - [x] Skill structure validation: `npm run validate:skills` - [x] Link validation: `npm run lint:md-links` - [x] PowerShell analysis: `npm run lint:ps` - [x] Plugin freshness: `npm run plugin:generate` ## Security Considerations <!-- ⚠️ WARNING: Do not commit sensitive information such as API keys, passwords, or personal data --> - [x] This PR does not contain any sensitive or NDA information - [x] Any new dependencies have been reviewed for security issues (N/A — no dependency changes) - [x] Security-related scripts follow the principle of least privilege ## Additional Notes This is a minimal, single-line change that satisfies the OpenSSF Scorecard Token-Permissions requirement by adding an explicit `permissions: {}` block to the only job in *extension-publish-prerelease.yml* that lacked one. The empty permissions declaration correctly reflects that the job needs no elevated token permissions beyond what is inherited. Co-authored-by: Bill Berry <wbery@microsoft.com> Co-authored-by: Katrien De Graeve <katriendg@users.noreply.github.com>
1 parent 1cf04b1 commit b7db43b

1 file changed

Lines changed: 1 addition & 0 deletions

File tree

‎.github/workflows/extension-publish-prerelease.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ jobs:
2121
validate-version:
2222
name: Validate Pre-Release Version
2323
runs-on: ubuntu-latest
24+
permissions: {}
2425
outputs:
2526
version: ${{ steps.validate.outputs.version }}
2627
steps:

0 commit comments

Comments
 (0)