Conversation
# Conflicts: # packages/plasma-asdk/package.json
handle ISO 4217 for currency
replace `--surface-solid-primary` `--surface-solid-secondary`
Yakutoc
requested review from
TitanKuzmich,
Yeti-or,
neretin-trike and
shuga2704
as code owners
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| name: Upload ${{ matrix.package_name }} MCP data | ||
| if: ${{ github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success' }} | ||
| runs-on: ubuntu-22.04 | ||
| strategy: | ||
| fail-fast: false | ||
| matrix: | ||
| include: | ||
| - package_name: plasma-web | ||
| - package_name: plasma-b2c | ||
| - package_name: plasma-giga | ||
| - package_name: sdds-finai | ||
| steps: | ||
| - name: Checkout manual ref | ||
| if: ${{ github.event_name == 'workflow_dispatch' }} | ||
| uses: actions/checkout@v4 | ||
| with: | ||
| show-progress: false | ||
|
|
||
| - name: Checkout release commit | ||
| if: ${{ github.event_name == 'workflow_run' }} | ||
| uses: actions/checkout@v4 | ||
| with: | ||
| ref: ${{ github.event.workflow_run.head_sha }} | ||
| show-progress: false | ||
|
|
||
| - name: Prepare environment | ||
| uses: ./.github/actions/prepare-environment | ||
|
|
||
| - name: Read ${{ matrix.package_name }} version | ||
| run: | | ||
| PACKAGE_VERSION=$(node -p "require('./packages/${{ matrix.package_name }}/package.json').version") | ||
| echo "PACKAGE_VERSION=$PACKAGE_VERSION" >> $GITHUB_ENV | ||
| echo "S3_TARGET_VERSION_PATH=s3://${{ secrets.AWS_S3_BUCKET_2 }}/mcp/${{ matrix.package_name }}/$PACKAGE_VERSION/" >> $GITHUB_ENV | ||
| echo "S3_TARGET_LATEST_PATH=s3://${{ secrets.AWS_S3_BUCKET_2 }}/mcp/${{ matrix.package_name }}/latest/" >> $GITHUB_ENV | ||
|
|
||
| - name: Lerna bootstrap | ||
| uses: nick-fields/retry@v3 | ||
| with: | ||
| timeout_minutes: 30 | ||
| max_attempts: 2 | ||
| retry_on: error | ||
| command: npx lerna bootstrap | ||
|
|
||
| - name: Build ${{ matrix.package_name }}-docs | ||
| env: | ||
| NODE_OPTIONS: "--max_old_space_size=10240" | ||
| run: npm run build --prefix="./website/${{ matrix.package_name }}-docs" -- --no-minify | ||
|
|
||
| - name: Generate index | ||
| run: npm run generate-index --prefix="./website/${{ matrix.package_name }}-docs" | ||
|
|
||
| - name: Generate MCP data | ||
| run: npm run generate-mcp-data --prefix="./website/${{ matrix.package_name }}-docs" | ||
|
|
||
| - name: Install s3cmd | ||
| run: pip3 install s3cmd | ||
|
|
||
| - name: Clean target S3 path | ||
| run: | | ||
| s3cmd \ | ||
| --access_key ${{ secrets.AWS_ACCESS_KEY_ID }} \ | ||
| --secret_key ${{ secrets.AWS_SECRET_ACCESS_KEY }} \ | ||
| --host ${{ secrets.AWS_ENDPOINT }} \ | ||
| --host-bucket ${{ secrets.AWS_ENDPOINT }} \ | ||
| --bucket-location ${{ secrets.AWS_REGION }} \ | ||
| --signature-v2 \ | ||
| del \ | ||
| --recursive \ | ||
| --force \ | ||
| ${{ env.S3_TARGET_VERSION_PATH }} | ||
|
|
||
| - name: Upload MCP data to versioned s3 path | ||
| run: > | ||
| s3cmd | ||
| --access_key ${{ secrets.AWS_ACCESS_KEY_ID }} | ||
| --secret_key ${{ secrets.AWS_SECRET_ACCESS_KEY }} | ||
| --host ${{ secrets.AWS_ENDPOINT }} | ||
| --host-bucket ${{ secrets.AWS_ENDPOINT }} | ||
| --bucket-location ${{ secrets.AWS_REGION }} | ||
| --signature-v2 | ||
| --delete-removed | ||
| --no-mime-magic | ||
| sync | ||
| ./website/${{ matrix.package_name }}-docs/mcpData/ | ||
| ${{ env.S3_TARGET_VERSION_PATH }} | ||
|
|
||
| - name: Clean latest S3 path | ||
| run: | | ||
| s3cmd \ | ||
| --access_key ${{ secrets.AWS_ACCESS_KEY_ID }} \ | ||
| --secret_key ${{ secrets.AWS_SECRET_ACCESS_KEY }} \ | ||
| --host ${{ secrets.AWS_ENDPOINT }} \ | ||
| --host-bucket ${{ secrets.AWS_ENDPOINT }} \ | ||
| --bucket-location ${{ secrets.AWS_REGION }} \ | ||
| --signature-v2 \ | ||
| del \ | ||
| --recursive \ | ||
| --force \ | ||
| ${{ env.S3_TARGET_LATEST_PATH }} | ||
|
|
||
| - name: Upload MCP data to latest s3 path | ||
| run: > | ||
| s3cmd | ||
| --access_key ${{ secrets.AWS_ACCESS_KEY_ID }} | ||
| --secret_key ${{ secrets.AWS_SECRET_ACCESS_KEY }} | ||
| --host ${{ secrets.AWS_ENDPOINT }} | ||
| --host-bucket ${{ secrets.AWS_ENDPOINT }} | ||
| --bucket-location ${{ secrets.AWS_REGION }} | ||
| --signature-v2 | ||
| --delete-removed | ||
| --no-mime-magic | ||
| sync | ||
| ./website/${{ matrix.package_name }}-docs/mcpData/ | ||
| ${{ env.S3_TARGET_LATEST_PATH }} |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 24 days ago
In general, to fix this type of issue you explicitly define permissions: either at the workflow level (applies to all jobs) or for the specific job, limiting the GITHUB_TOKEN to the minimal scopes needed. For this workflow, the job only needs to read repository contents (for checkout); all deployment actions use AWS credentials via secrets and interact with S3 directly, not GitHub. So contents: read is sufficient and matches the minimal recommendation from CodeQL.
The best fix with no functional change is to add a permissions: block for the upload-mcp-data job (or at the workflow root). To keep the edit tightly scoped to the code shown, we’ll add it at the job level under upload-mcp-data:. Concretely, in .github/workflows/mcp-data-upload.yml, after line 12 (the job name:), insert:
permissions:
contents: readwith indentation matching the existing YAML structure (8 spaces before permissions and 12 before contents). No additional imports or methods are required since this is a configuration-only change.
| @@ -10,6 +10,8 @@ | ||
| jobs: | ||
| upload-mcp-data: | ||
| name: Upload ${{ matrix.package_name }} MCP data | ||
| permissions: | ||
| contents: read | ||
| if: ${{ github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success' }} | ||
| runs-on: ubuntu-22.04 | ||
| strategy: |
| name: Release PLATFORM-AI next branch | ||
| if: github.ref == 'refs/heads/next-platform-ai' | ||
| uses: ./.github/workflows/publish-common.yml | ||
| with: | ||
| auto-options: '--no-changelog' | ||
| secrets: | ||
| gh_token: ${{ secrets.GH_TOKEN }} | ||
| npm_registry_token: ${{ secrets.NPM_REGISTRY_TOKEN }} |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 24 days ago
In general, the fix is to add an explicit permissions: block that grants only the minimal required scopes to the GITHUB_TOKEN. This can be done at the workflow root (applying to all jobs without their own permissions) or at the job level. Here, there is a single publish job that delegates to a reusable workflow; the safest non-breaking change is to define conservative permissions at the workflow root, which the reusable workflow can still narrow further if needed.
Concretely, in .github/workflows/publish-platform-ai.yml, add a permissions: block after the on: section (before concurrency:). As a minimal secure default for a release/publish workflow, use read-only repository access unless you know it must write to contents, deployments, etc. Since we must avoid assumptions about additional behavior, we will restrict to contents: read and packages: read, which aligns with GitHub’s recommended minimal starting point and does not introduce new functionality. If publish-common.yml needs broader rights, it should declare them explicitly itself. No imports or additional methods are needed; this is purely a YAML configuration change.
| @@ -8,6 +8,10 @@ | ||
| required: true | ||
| default: 'next-platform-ai' | ||
|
|
||
| permissions: | ||
| contents: read | ||
| packages: read | ||
|
|
||
| concurrency: | ||
| group: ${{ github.workflow }}-${{ github.ref }} | ||
| cancel-in-progress: true |
| name: Release SBCOM next branch | ||
| if: github.ref == 'refs/heads/next-sbcom' | ||
| uses: ./.github/workflows/publish-common.yml | ||
| with: | ||
| auto-options: '--no-changelog' | ||
| secrets: | ||
| gh_token: ${{ secrets.GH_TOKEN }} | ||
| npm_registry_token: ${{ secrets.NPM_REGISTRY_TOKEN }} |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 24 days ago
To fix the problem, add an explicit permissions block so the GITHUB_TOKEN rights are constrained instead of inheriting potentially broad repository defaults. Since this workflow only dispatches a reusable workflow and does not itself interact with repository contents, a safe minimal starting point is contents: read. If the reusable workflow needs broader rights, those should be declared in that workflow; here we only need to ensure this caller workflow is not implicitly granting write access.
The single best change that preserves existing behavior is to add a root‑level permissions section near the top of .github/workflows/publish-sbcom.yml, after the name (or before on:), with least‑privilege read access to repo contents. Concretely, in .github/workflows/publish-sbcom.yml, insert:
permissions:
contents: readbetween line 2 and line 3. No imports or additional definitions are required, as this is purely a YAML configuration change.
| @@ -1,5 +1,8 @@ | ||
| name: Release SBCOM next branch | ||
|
|
||
| permissions: | ||
| contents: read | ||
|
|
||
| on: | ||
| workflow_dispatch: | ||
| inputs: |
|
Theme Builder app deployed! https://plasma.sberdevices.ru/pr/plasma-theme-builder-pr-2611/ |
9 participants
Core
TextField
PR
NumberInput
добавлено свойство
displayWithoutValueдля отображения компонента без значениядобавлено свойство
limitBehaviorдля управления поведением кнопок при достижении граничных значенийPR
Sheet
body.style.overflowYPR
Price
typeдля свойстваcurrencyдоstring, что бы можно было указать валидное значение изISO 4217(а не только из предустановленного списка)PR
Attach
callbackonClearPR
Popover
улучшены примеры документации
добавлен пример как избежать потерю скругления между компонентом и slot контейнером
добавлено наследование для
border-radiusна уровнеpopover.stylePR
SDDS-PLATFORM-AI
Rating, DateTimePicker, DatePicker
PR
PLASMA-GIGA
Theme
SurfaceDefaultCardPR
SDDS-CS
Button, IconButton
buttonBackgroundнаsurface-solid-secondaryPR
Build
styled-components. По умолчанию сталаemotion;PR