Skip to content

Updated Phase 1 #107

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
omsherikar merged 1 commit into from
Sep 17, 2026
Merged

Updated Phase 1 #107

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/auto-label.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ on:
permissions:
issues: write
pull-requests: write
contents: read
contents: write
Comment on lines 10 to +13

@coderabbitai coderabbitai Bot Mar 10, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

cat -n .github/workflows/auto-label.yml

Repository: Refactron-ai/Refactron_lib

Length of output: 9853

🌐 Web query:

GitHub Actions checkout action permissions required contents read write

💡 Result:

actions/checkout itself only needs the job’s GITHUB_TOKEN to be able to read the repository contents, so the minimal permission is:

permissions:
  contents: read

This is also what the checkout action explicitly recommends. [1]

You only need contents: write if your workflow will write back to the repo (e.g., git push, creating/updating tags, committing generated files, etc.). [1]

Background: GitHub lets you set these token permissions per-workflow/job via the permissions: key (anything omitted becomes none). [2] GitHub also moved newer orgs/repos toward a read-only default token for security, but you can still opt into read/write when needed. [3]

🌐 Web query:

github.rest.pulls.listFiles API permission requirements

💡 Result:

For github.rest.pulls.listFiles (REST: GET /repos/{owner}/{repo}/pulls/{pull_number}/files):

  • Fine-grained PAT / GitHub App tokens: require Repository permissions → “Pull requests”: Read. [1]
  • Public repositories: the endpoint can be called without authentication (and thus without the above permissions) when only public resources are requested. [1]

Sources

  1. GitHub Docs — REST API endpoints for pull requests → “List pull requests files” (fine-grained token permissions + public-access note). [1]

🌐 Web query:

github.rest.issues.addLabels API permission requirements GitHub token scopes

💡 Result:

github.rest.issues.addLabels calls POST /repos/{owner}/{repo}/issues/{issue_number}/labels (“Add labels to an issue”). It requires write permission to Issues (or PRs). [1]

Fine-grained PATs / GitHub App tokens

Grant one of these repository permissions (write): [1]

  • Issues: write (for issues), or
  • Pull requests: write (labels on PRs use the same “issues” labels endpoints)

GitHub’s fine-grained permissions matrix also lists this endpoint as requiring write access. [2]

Classic PATs / OAuth app tokens (scopes)

Use: [3]

  • repo for private repositories (and also works for public), or
  • public_repo if you only need to label issues in public repositories

Sources: [1] GitHub REST “Labels” API (Add labels to an issue) (docs.github.com), [2] Fine-grained PAT permissions matrix (docs.github.com), [3] GitHub OAuth/PAT scopes (repo, public_repo) (docs.github.com)

Citations:

Downgrade contents permission to read.

This workflow only checks out the repo, lists PR files, and adds labels via the Issues API. GitHub's official documentation recommends contents: read for actions/checkout; pulls.listFiles needs only pull-requests: read; and label writes use the Issues API with issues: write or pull-requests: write. No step in this workflow writes back to repository contents, making contents: write an unnecessary privilege. Since actions/checkout persists the authentication token for subsequent steps by default, an over-privileged token increases the blast radius if future steps are added.

Suggested fix 
 permissions:
   issues: write
   pull-requests: write
-  contents: write
+  contents: read
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
permissions:
issues: write
pull-requests: write
contents: read
contents: write
permissions:
issues: write
pull-requests: write
contents: read
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/auto-label.yml around lines 10 - 13, The workflow is
granting excessive repo write rights; change the permissions block so that
issues remains write but contents is downgraded to read and pull-requests is
changed to read (i.e., set "contents: read" and "pull-requests: read" while
keeping "issues: write") to match what actions/checkout and pulls.listFiles need
and reduce token blast radius.


jobs:
label-issues:
Expand Down
Loading