fix(ci): add top-level permissions and concurrency to workflows#12312
fix(ci): add top-level permissions and concurrency to workflows#12312Jefsky wants to merge 1 commit into
Conversation
dosubot
Bot
added
the
size:XS
📝 WalkthroughWalkthroughThis PR systematically adds GitHub Actions workflow security and concurrency controls across 18 workflows. Write-enabled workflows receive explicit permissions for contents and pull-requests, CI validation workflows receive read-only content permissions, and cloud/release workflows receive concurrency configuration to prevent overlapping executions or preserve in-flight releases. ChangesWorkflow Security and Concurrency Controls
Estimated code review effort🎯 2 (Simple) | ⏱️ ~8 minutes Poem
🚥 Pre-merge checks | ✅ 7✅ Passed checks (7 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Tip 💬 Introducing Slack Agent: The best way for teams to turn conversations into code.Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.
Built for teams:
One agent for your entire SDLC. Right inside Slack. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
🎨 Storybook:
|
🎭 Playwright: ⏳ Running... |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
.github/workflows/version-bump-desktop-ui.yaml (1)
23-25: Verify concurrency behavior for different input branches.The concurrency group
${{ github.workflow }}-${{ github.ref }}serializes all manual triggers of this workflow from the same ref, regardless of thebranchinput. If a user triggers a version bump forcore/1.29and another triggers a bump forcore/1.30, the second will wait for the first to complete.If concurrent version bumps for different target branches are desired, consider including the input parameter in the group:
concurrency: group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event.inputs.branch }} cancel-in-progress: falseIf serializing all version bumps is intentional for controlled sequential execution, the current implementation is correct.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/version-bump-desktop-ui.yaml around lines 23 - 25, The concurrency group currently uses `${{ github.workflow }}-${{ github.ref }}` which serializes all manual runs on the same ref regardless of the workflow input `branch`; update the concurrency `group` to include the input parameter (e.g., append `${{ github.event.inputs.branch }}`) so runs targeting different branches (like `core/1.29` vs `core/1.30`) can run concurrently, or leave it as-is if intentional serial execution is desired—change the `concurrency.group` value accordingly.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ci-tests-storybook.yaml:
- Around line 10-12: Add a workflow-level permissions baseline by declaring a
top-level "permissions: contents: read" in the workflow YAML so the workflow no
longer inherits broader repository GITHUB_TOKEN scopes; keep the existing
job-level permission overrides for the PR-comment-related jobs (e.g.,
storybook-build, chromatic-deployment, deploy-production) intact to maintain
their specific privileges while enforcing least-privilege for the whole workflow
that currently contains the "concurrency" block with "group" and
"cancel-in-progress".
---
Nitpick comments:
In @.github/workflows/version-bump-desktop-ui.yaml:
- Around line 23-25: The concurrency group currently uses `${{ github.workflow
}}-${{ github.ref }}` which serializes all manual runs on the same ref
regardless of the workflow input `branch`; update the concurrency `group` to
include the input parameter (e.g., append `${{ github.event.inputs.branch }}`)
so runs targeting different branches (like `core/1.29` vs `core/1.30`) can run
concurrently, or leave it as-is if intentional serial execution is
desired—change the `concurrency.group` value accordingly.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: ccd455c8-eb17-4ef7-9f2f-b17238bfdc8c
📒 Files selected for processing (20)
.github/workflows/api-update-electron-api-types.yaml.github/workflows/api-update-manager-api-types.yaml.github/workflows/ci-json-validation.yaml.github/workflows/ci-python-validation.yaml.github/workflows/ci-shell-validation.yaml.github/workflows/ci-tests-storybook.yaml.github/workflows/ci-yaml-validation.yaml.github/workflows/cloud-backport-tag.yaml.github/workflows/cloud-dispatch-cleanup.yaml.github/workflows/i18n-update-core.yaml.github/workflows/i18n-update-custom-nodes.yaml.github/workflows/i18n-update-nodes.yaml.github/workflows/model-page-discovery.yaml.github/workflows/pr-request-team-review.yaml.github/workflows/publish-desktop-ui-on-merge.yaml.github/workflows/release-biweekly-comfyui.yaml.github/workflows/release-branch-create.yaml.github/workflows/release-draft-create.yaml.github/workflows/release-pypi-dev.yaml.github/workflows/version-bump-desktop-ui.yaml
| concurrency: | ||
| group: ${{ github.workflow }}-${{ github.ref }} | ||
| cancel-in-progress: true |
There was a problem hiding this comment.
Add an explicit workflow-level permission baseline.
This workflow still leaves storybook-build, chromatic-deployment, and deploy-production on the repository default GITHUB_TOKEN scopes. That undercuts the least-privilege hardening this PR is applying elsewhere. Add a top-level permissions: contents: read here and keep the existing job-level overrides for the PR-comment jobs.
Suggested patch
+permissions:
+ contents: read
+
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/ci-tests-storybook.yaml around lines 10 - 12, Add a
workflow-level permissions baseline by declaring a top-level "permissions:
contents: read" in the workflow YAML so the workflow no longer inherits broader
repository GITHUB_TOKEN scopes; keep the existing job-level permission overrides
for the PR-comment-related jobs (e.g., storybook-build, chromatic-deployment,
deploy-production) intact to maintain their specific privileges while enforcing
least-privilege for the whole workflow that currently contains the "concurrency"
block with "group" and "cancel-in-progress".
1 participant
Summary
Adds missing
permissionsandconcurrencyblocks to GitHub Actions workflows, addressing:Changes by category
Read-only permissions + concurrency:
ci-json-validation,ci-python-validation,ci-shell-validation,ci-yaml-validationci-tests-storybook,model-page-discoveryWrite permissions + concurrency:
api-update-electron-api-types,api-update-manager-api-typesi18n-update-core,i18n-update-custom-nodes,i18n-update-nodesConcurrency only — cancel=false (release/deploy):
release-biweekly-comfyui,release-branch-create,release-draft-createrelease-pypi-dev,version-bump-desktop-ui,publish-desktop-ui-on-mergeConcurrency only — cancel=true:
cloud-backport-tag,cloud-dispatch-cleanup,pr-request-team-review┆Issue is synchronized with this Notion page by Unito