v1.0.4

[yilmaztayfun]

Summary by Sourcery

Update GitHub Actions build-and-publish workflow permissions for publishing and tagging.

Build:

• Grant workflow permissions to write repository contents for creating tags and releases.
• Grant workflow permissions to write packages for publishing to GitHub Packages.

[gemini-code-assist]

Note

Gemini is unable to generate a summary for this pull request due to the file types involved not being currently supported.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: bd3da7bd-b991-46ed-b209-b6ab5be97206

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch master

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[sourcery-ai]

Reviewer's guide (collapsed on small PRs)

Reviewer's Guide

Updates the build-and-publish GitHub Actions workflow to grant additional GitHub token permissions needed for tagging, creating releases, and publishing to GitHub Packages.

Sequence diagram for build-and-publish workflow with extended permissions

sequenceDiagram
  participant Workflow_build_and_publish
  participant Job_build_and_publish
  participant GitHub_API
  participant npm_registry
  participant GitHub_Packages

  Workflow_build_and_publish->>Job_build_and_publish: Start job
  Job_build_and_publish->>GitHub_API: Request OIDC token (id-token write)
  GitHub_API-->>Job_build_and_publish: OIDC token

  Job_build_and_publish->>npm_registry: Publish package using OIDC auth
  npm_registry-->>Job_build_and_publish: Publish success

  Job_build_and_publish->>GitHub_API: Create git tag (contents write)
  GitHub_API-->>Job_build_and_publish: Tag created

  Job_build_and_publish->>GitHub_API: Create release (contents write)
  GitHub_API-->>Job_build_and_publish: Release created

  Job_build_and_publish->>GitHub_Packages: Publish package (packages write)
  GitHub_Packages-->>Job_build_and_publish: Package published

Loading

File-Level Changes

Change	Details	Files
Adjust GitHub Actions workflow permissions so the job can create tags/releases and publish packages.	Grant write access to repository contents via the GITHUB_TOKEN to allow creating git tags and GitHub releases within the workflow job. Grant write access to packages via the GITHUB_TOKEN to allow publishing artifacts to GitHub Packages from the workflow job.	.github/workflows/build-and-publish.yml

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sourcery-ai]

Hey - I've left some high level feedback:

• Consider scoping the added contents: write and packages: write permissions more narrowly (e.g., to specific jobs or branches) to adhere to least-privilege principles and reduce potential impact if the workflow is abused.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- Consider scoping the added `contents: write` and `packages: write` permissions more narrowly (e.g., to specific jobs or branches) to adhere to least-privilege principles and reduce potential impact if the workflow is abused.

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}