fix: authorize vulnerability alert reads#127
Conversation
WalkthroughThe vulnerability triage workflow now grants its token ChangesVulnerability triage workflow
Estimated code review effort: 1 (Trivial) | ~2 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/vulnerability-triage.yml:
- Line 12: Update the workflow linting configuration used for
vulnerability-triage.yml so actionlint recognizes the vulnerability-alerts
permission scope, preferably by upgrading actionlint beyond 1.7.12; otherwise
configure the linter to tolerate this supported scope. Preserve
vulnerability-alerts: read unchanged.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 77ae9431-344a-4e70-b26d-4f392213efc2
📒 Files selected for processing (1)
.github/workflows/vulnerability-triage.yml
| contents: read | ||
| packages: read | ||
| security-events: read | ||
| vulnerability-alerts: read |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Repository files matching actionlint/workflows:"
git ls-files | rg '(^|/)(actionlint|.*lint.*|workflow|yml|yaml)$' || true
echo
echo "Target workflow:"
if [ -f .github/workflows/vulnerability-triage.yml ]; then
nl -ba .github/workflows/vulnerability-triage.yml | sed -n '1,80p'
else
echo "missing .github/workflows/vulnerability-triage.yml"
fi
echo
echo "Search for actionlint usage/config/versions:"
rg -n "actionlint|rhysd|security-audit|vulnerability-alerts" -S .github . 2>/dev/null || true
echo
echo "Version/actionlint command hints in workflow YAMLs:"
python3 - <<'PY'
import pathlib, re, subprocess
for p in subprocess.check_output(['git','ls-files','.github/workflows'], text=True).splitlines():
text = pathlib.Path(p).read_text(errors='replace')
if 'actionlint' in text or 'security-audit' in text or 'vulnerability-alerts' in text:
print(f"\n--- {p} ---")
lines=text.splitlines()
for i,l in enumerate(lines,1):
if any(k in l for k in ['actionlint','security-audit','vulnerability-alerts']):
lo=max(1,i-3); hi=min(len(lines),i+5)
print(f"@@ {lo}-{hi}")
for n in range(lo,hi+1):
print(f"{n:4}: {lines[n-1]}")
PYRepository: sourcebot-dev/sourcebot-helm-chart
Length of output: 313
🏁 Script executed:
#!/bin/bash
set -euo pipefail
if ! command -v actionlint >/dev/null 2>&1; then
echo "actionlint is not available in this environment"
exit 0
fi
actionlint --version 2>/dev/null || true
tmp="$(mktemp -d)"
trap 'rm -rf "$tmp"' EXIT
printf '%s\n' 'name: test
on: push
jobs:
a:
runs-on: ubuntu-latest
permissions:
security-events: write
vulnerability-alerts: read
steps:
- run: true
' > "$tmp/test.yml"
echo "actionlint permissions check for vulnerability-alerts/read:"
actionlint "$tmp/test.yml" 2>&1 || true
echo
echo "actionlint permissions check for unknown permission:"
printf '%s\n' 'name: test
on: push
jobs:
a:
runs-on: ubuntu-latest
permissions:
security-events: write
foo-bar: read
steps:
- run: true
' > "$tmp/test2.yml"
actionlint "$tmp/test2.yml" 2>&1 || true
echo
echo "Relevant actionlint source references if available in Go module cache:"
mod="$(go env GOPATH 2>/dev/null)/pkg/mod"
[ -n "$mod" ] && rg -n "vulnerability-alerts|security-audit|permissions" "$mod" 2>/dev/null | head -80 || trueRepository: sourcebot-dev/sourcebot-helm-chart
Length of output: 1289
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Fetching available actionlint GitHub tags/releases"
python3 - <<'PY'
import urllib.request
try:
with urllib.request.urlopen("https://api.github.com/repos/rhysd/actionlint/tags", timeout=20) as r:
tags=[t["name"] for t in r.read().decode().splitlines()[:0]]
for line in r.readline():
print(line)
except Exception as e:
print(type(e).__name__, e)
PYRepository: sourcebot-dev/sourcebot-helm-chart
Length of output: 366
Update actionlint before merging.
vulnerability-alerts: read is a supported GitHub Actions permission, but actionlint 1.7.12 rejects it as an unknown permission scope. Upgrade actionlint to a version that includes this scope, or configure the linter to tolerate it.
🧰 Tools
🪛 actionlint (1.7.12)
[error] 12-12: unknown permission scope "vulnerability-alerts". all available permission scopes are "actions", "artifact-metadata", "attestations", "checks", "contents", "deployments", "discussions", "id-token", "issues", "models", "packages", "pages", "pull-requests", "repository-projects", "security-events", "statuses"
(permissions)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/vulnerability-triage.yml at line 12, Update the workflow
linting configuration used for vulnerability-triage.yml so actionlint recognizes
the vulnerability-alerts permission scope, preferably by upgrading actionlint
beyond 1.7.12; otherwise configure the linter to tolerate this supported scope.
Preserve vulnerability-alerts: read unchanged.
Source: Linters/SAST tools
1 participant
The scheduled vulnerability triage started failing after the shared reusable workflow began requesting
vulnerability-alerts: read.Grant that permission in the caller so GitHub can start the reusable workflow and query Dependabot alerts.
Validation: YAML parsing and
git diff --checkpass.Note
Low Risk
Single CI permission addition with no application or data-path changes.
Overview
Adds
vulnerability-alerts: readto the scheduled Vulnerability Triage caller workflow’spermissionsblock.The reusable
sourcebot-dev/sourcebottriage workflow now needs that scope to read Dependabot alerts; without it on the caller, GitHub won’t start the job after the upstream change.Reviewed by Cursor Bugbot for commit e3c006b. Bugbot is set up for automated code reviews on this repo. Configure here.
Summary by CodeRabbit