tiennm99/ccs
1
0
Fork 0
mirror of https://github.com/tiennm99/ccs.git synced 2026-07-16 12:15:57 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(ci): constrain PR-Agent GitHub App token permissions (#1370)

Browse Source 
* fix(ci): constrain pr-agent app token permissions

* style: apply prettier formatting
This commit is contained in:
Kai (Tam Nhu) Tran
2026-05-23 21:44:47 -04:00
committed by GitHub
parent 4e7894a3da
commit 37fdf90e30
2 changed files with 7 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/ai-review.yml
+4
View File
@@ -48,6 +48,7 @@ jobs:
with:
app-id: ${{ secrets.CCS_REVIEWER_APP_ID }}
private-key: ${{ secrets.CCS_REVIEWER_PRIVATE_KEY }}
permission-issues: write
- name: Post /review command to the PR
uses: actions/github-script@v7
@@ -111,6 +112,9 @@ jobs:
with:
app-id: ${{ secrets.CCS_REVIEWER_APP_ID }}
private-key: ${{ secrets.CCS_REVIEWER_PRIVATE_KEY }}
permission-issues: write
permission-pull-requests: write
permission-contents: read
- name: Run PR-Agent
uses: qodo-ai/pr-agent@v0.34
tests/unit/scripts/github/ai-review-workflow.test.ts
+3
View File
@@ -44,6 +44,9 @@ describe('PR-Agent review lane migration', () => {
expect(workflow).toContain('CCS_REVIEWER_APP_ID');
expect(workflow).toContain('CCS_REVIEWER_PRIVATE_KEY');
expect(workflow).toContain('id: pr-agent-app-token');
expect(workflow).toContain('permission-issues: write');
expect(workflow).toContain('permission-pull-requests: write');
expect(workflow).toContain('permission-contents: read');
expect(workflow).toContain('GITHUB_TOKEN: ${{ steps.pr-agent-app-token.outputs.token }}');
expect(workflow).not.toContain('GITHUB_TOKEN: ${{ github.token }}');
expect(workflow).not.toContain('uses: anthropics/claude-code-action@v1');