Enhance reusable workflows#80
Merged
Merged
Conversation
Co-authored-by: Yaswant Pradhan <2984440+yaswant@users.noreply.github.com>
This was referenced Jul 17, 2026
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 23 out of 23 changed files in this pull request and generated 3 comments.
Comments suppressed due to low confidence (1)
.github/workflows/call-track-review-project.yaml:31
- In reusable-workflow calls, the caller job
permissionssets the maximum permissions the called workflow can use. This caller only grantsactions: readandrepository-projects: write, but the calledtrack-review-project.yamljob requires at leastcontents: readandpull-requests: write(it runsgh pr edit). As written, the called workflow will fail when it tries to read/modify PR metadata.
permissions:
actions: read # Required to view the status of the upstream triggered workflow run
repository-projects: write # Required to add or mutate tasks inside GitHub Project 376
Comment on lines
+114
to
121
| # Use gh api to query pull request metadata directly | ||
| # without network git ls-remote authentication | ||
| mergeable=$(gh api "repos/$REPOSITORY/pulls/$PR_NUMBER" --jq ".mergeable" 2>/dev/null || echo "undefined") | ||
| if [ "$mergeable" != "undefined" ]; then | ||
| echo "merge_ref_defined=true" >> "$GITHUB_ENV" | ||
| else | ||
| echo "merge_ref_defined=true" >> $GITHUB_ENV | ||
| echo "merge_ref_defined=false" >> "$GITHUB_ENV" | ||
| fi |
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 23 out of 23 changed files in this pull request and generated 1 comment.
Comments suppressed due to low confidence (3)
.github/workflows/call-track-review-project.yaml:31
MetOffice/growss/.github/workflows/track-review-project.yamlrequestsactions: read,contents: read, andpull-requests: writeat job level. For reusable workflows, the called workflow'sGITHUB_TOKENpermissions are constrained by the caller; this caller currently omitscontents/pull-requests, which can cause the called workflow to fail when checking out or editing PR metadata.
permissions:
actions: read # Required to view the status of the upstream triggered workflow run
repository-projects: write # Required to add or mutate tasks inside GitHub Project 376
.github/workflows/cla-check.yaml:118
mergeableis not a reliable proxy for whetherrefs/pull/<n>/mergeexists (it can benullwhile GitHub computes mergeability, and can be present even when merge refs are unavailable due to conflicts). This can cause the workflow to attempt a merge-ref checkout when the ref doesn't exist (or skip it when it does). Prefer checking the ref directly via the Git refs API.
# Use gh api to query pull request metadata directly
# without network git ls-remote authentication
mergeable=$(gh api "repos/$REPOSITORY/pulls/$PR_NUMBER" --jq ".mergeable" 2>/dev/null || echo "undefined")
if [ "$mergeable" != "undefined" ]; then
echo "merge_ref_defined=true" >> "$GITHUB_ENV"
.github/workflows/fortran-lint.yaml:117
${CONFIG_PATH:++...}is expanded unquoted, which allows word-splitting/globbing ifconfig-pathcontains spaces or shell metacharacters. Since these are workflow inputs, it's safer to build the argument list via theARGSarray (as you already do for the boolean flags) and keep everything quoted.
uvx --from "fortitude-lint==$FORTITUDE_VERSION" fortitude check \
"${ARGS[@]}" \
"--file-extensions=$FILE_EXTENSIONS" \
${CONFIG_PATH:+"--config-file=$CONFIG_PATH"} \
"$SOURCE_PATH"
Comment on lines
+21
to
+27
| if: >- | ||
| github.event_name == 'workflow_dispatch' || | ||
| ( | ||
| github.event_name == 'workflow_run' && | ||
| github.event.workflow_run.event == 'push' && | ||
| github.event.workflow_run.conclusion == 'success' | ||
| ) |
James Bruten (james-bruten-mo)
approved these changes
Jul 22, 2026
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 23 out of 23 changed files in this pull request and generated 3 comments.
Comments suppressed due to low confidence (2)
.github/workflows/call-track-review-project.yaml:25
- The caller workflow grants only
actions: readandrepository-projects: write, but the called reusable workflow (track-review-project.yaml) requestscontents: read(checkout) andpull-requests: write(PR edits). For reusable workflows, the effectiveGITHUB_TOKENpermissions are capped by the caller, so this will break checkout and PR updates.
permissions:
actions: read # Required to view the status of the upstream triggered workflow run
repository-projects: write # Required to add or mutate tasks inside GitHub Project 376
uses: MetOffice/growss/.github/workflows/track-review-project.yaml@main
.github/workflows/cla-check.yaml:118
merge_ref_definedis currently set to true whenever the PR API call succeeds, regardless of whether a merge ref actually exists (e.g., for merge conflicts). This makes the later conditional logic misleading and can trigger a failing checkout ofrefs/pull/.../merge. Use the Git refs API to test existence ofpull/<PR>/mergeinstead.
# Use gh api to query pull request metadata directly
# without network git ls-remote authentication
mergeable=$(gh api "repos/$REPOSITORY/pulls/$PR_NUMBER" --jq ".mergeable" 2>/dev/null || echo "undefined")
if [ "$mergeable" != "undefined" ]; then
echo "merge_ref_defined=true" >> "$GITHUB_ENV"
Comment on lines
29
to
31
| with: | ||
| runner: "ubuntu-22.04" | ||
| runner: "ubuntu-slim" | ||
| project_org: "MetOffice" |
Comment on lines
+19
to
+21
| permissions: | ||
| contents: read # Required for checking out code or referencing internal workflow actions | ||
| pull-requests: write # Required for the composite action to add or remove labels on the PR |
Comment on lines
+26
to
29
| permissions: | ||
| contents: read | ||
| pull-requests: write # Required to add labels and comments | ||
| runs-on: ${{ inputs.runner }} |
James Bruten (james-bruten-mo)
pushed a commit
to MetOffice/fab
that referenced
this pull request
Jul 22, 2026
# PR Summary Align repository actions with MetOffice/growss#80 Code Reviewer: @james-bruten-mo - linked MetOffice/growss#80
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
PR Summary
Hardens the GitHub Actions security baseline across all workflows.
Code Reviewer: James Bruten (@james-bruten-mo)
Downstream pull requests
List of downstream PR's need coordinated merge.
Action pinning
actions/checkout@v6→@df4cb1c…).actions/github-scriptintrack-review-project.yamlupgraded fromv8 → v9as part of the pin.Credential & permission scoping
persist-credentials: falseadded to everyactions/checkoutsteppermissions: {}set on caller workflows; granularcontents: read/pull-requests: write/actions: readpushed down to job level incall-track-review-project.yaml,call-trigger-project-workflow.yaml, andtrigger-project-workflow.yamlfortran-lint.yamlgains an explicit contents: read job permission.Template-injection fixes (zizmor)
cla-check.yaml: step outputs andinputs.cla-urlmoved toenv:vars, read viaprocess.env.*in thegithub-scriptblock.fortran-lint.yaml: all string/path inputs moved toenv:vars; boolean flags resolved in shell using a bash array.track-review-project.yaml:inputs.project_organdinputs.project_numbermoved toenv:vars. Also, includedPROJECT_ACTION_PATsecret as required parameter to avoid secret inheritance in caller workflow (breaking change! See updated README for usage).CLA workflow logic
git ls-remote → gh api repos/.../pulls/…(avoids unauthenticated git network call).CONTRIBUTORS.mdmodification check rewritten:git diff→ GitHub Contents API +base64 | tr | cmp(avoids authenticated git fetch from fork). File modification now checked against content instead of just file state.Tooling & config
dependabot.yaml: monthly schedule, major-version updates blocked, all action updates grouped into a single PRzizmor.yaml: suppressesunpinned-uses,dangerous-triggers, andsecrets-inheritfor the two caller workflows that usesecrets: inherit.yamllint: updatedignoresyntax; addedcommentsandcomments-indentationrules.To enforce strict GitHub Actions security baselines, we now use immutable 40-character commit SHAs.
✅ Code Quality Checklist
(Some checks are automatically carried out via the CI pipeline)
🤖 AI Assistance and Attribution
💻 Code Review