Repository navigation
ci: pin already-tested to substrax a61235a and grant the reads it makes - #34
Merged
Merged
Conversation
The already_tested job pins substrax a61235a. Its action reads only check results through its own query, and reads a pull request with no check as unproven, which the action at ec43d80 counted as proven. The job now names the contents, pull-requests, checks and statuses read the action makes: a public repository's token reads them anyway, and the grants keep the job working if the repository turns private.
mahdi-shafiei
force-pushed
the
ci/repin-already-tested
branch
from
October 29, 2026 06:07
2566b42 to
3ba9be1
Compare
mahdi-shafiei
marked this pull request as ready for review
October 29, 2026 20:00
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pins substrax's
already-testedaction toa61235a(substrax #68) and names the reads it makes.Change.
already_testedjob pins the action ata61235a. That action reads only check results through its own query. It also stops counting a pull request with no check as proven, which the action atec43d80did, so such a merge would have skipped its tests.contents,pull-requests,checksandstatusesread. A public repository's token reads those anyway. Naming them keeps the job working if the repository turns private: on the private repositories, the default token heldcontentsalone, and every merge reportedalready tested: false.Checked: pre-commit over the changed workflows, actionlint with shellcheck (its findings are the same set as on main, none in the changed lines), and avitai-portfolio's CI-rules checker on this branch. The checker's
already-tested-pin-is-staleandalready-tested-cannot-read-checksfindings are gone; every other finding is the same as on main.