Update dev #122

Av3boy · 2025-12-13T22:57:17Z

<Issue number> <Change title>

Checklist

I have merged the latest changes from main to my branch.
I have tested my changes and any affected components.
I have added the proper documentation about my changes
I have made sure there is no overlapping work.
I have discussed any / all issues brought up from code review.

Dev

on-behalf-of: @Azure opensource@microsoft.com

* #52 Temp * #52 Test --------- Co-authored-by: Antti Veikkolainen <antti.veikkolainen00@outlook.com>

on-behalf-of: @Azure opensource@microsoft.com

.github/workflows/publish-asset-store.yml

+    if: github.event_name == 'pull_request' && github.event.action == 'closed'
+    runs-on: ubuntu-latest
+    name: Close Pull Request Job
+    steps:
+      - name: Close Pull Request
+        id: closepullrequest
+        uses: Azure/static-web-apps-deploy@v1
+        with:
+          action: "close"


To fix the detected issue, explicitly set a permissions: block on the close_pull_request_job to restrict the GITHUB_TOKEN permissions. Since this job appears to only call Azure/static-web-apps-deploy@v1 with the action close and does not interact with repository contents or pull requests, you can set permissions: {} (none), or permissions: contents: read if the action requires reading repository code. As a minimal starting point and following least privilege, set permissions: {} at the job level for close_pull_request_job in .github/workflows/publish-asset-store.yml immediately before or after the runs-on: attribute.

.github/workflows/publish-web.yml

+    if: github.event_name == 'push' || (github.event_name == 'pull_request' && github.event.action != 'closed')
    runs-on: ubuntu-latest
+    name: Build and Deploy Job
    steps:
-      - name: Echo message
-        run: echo "Hello from the test branch 👋"
+      - uses: actions/checkout@v3
+        with:
+          submodules: true
+          lfs: false
+      - name: Build And Deploy
+        id: builddeploy
+        uses: Azure/static-web-apps-deploy@v1
+        with:
+          azure_static_web_apps_api_token: ${{ secrets.AZURE_STATIC_WEB_APPS_API_TOKEN_KIND_MEADOW_06167BF03 }}
+          repo_token: ${{ secrets.GITHUB_TOKEN }} # Used for Github integrations (i.e. PR comments)
+          action: "upload"
+          ###### Repository/Build Configurations - These values can be configured to match your app requirements. ######
+          # For more information regarding Static Web App workflow configurations, please visit: https://aka.ms/swaworkflowconfig
+          app_location: "./Portal/sharpengine-web-ui" # App source code path
+          # api_location: "" # Api source code path - optional
+          output_location: "build" # Built app content directory - optional
+          app_build_command: "CI=false npm run build"
+          ###### End of Repository/Build Configurations ######
+
+  close_pull_request_job:


To fix this issue, explicitly set the required permissions in the workflow. The minimal least-privilege block is permissions: contents: read at the top level. However, since the workflow uses the repo_token for Github integrations such as PR comments (as noted on line 29), we need at least contents: read and, if the integration posts comments to pull requests, also pull-requests: write. We should add the permissions block at the workflow root immediately after the name: field to apply to all jobs by default. This fix does not impact existing functionality but tightens security as recommended. No changes outside the YAML are required.

.github/workflows/publish-web.yml

+    if: github.event_name == 'pull_request' && github.event.action == 'closed'
+    runs-on: ubuntu-latest
+    name: Close Pull Request Job
+    steps:
+      - name: Close Pull Request
+        id: closepullrequest
+        uses: Azure/static-web-apps-deploy@v1
+        with:
+          azure_static_web_apps_api_token: ${{ secrets.AZURE_STATIC_WEB_APPS_API_TOKEN_KIND_MEADOW_06167BF03 }}
+          action: "close"


The best way to fix this issue is to add an explicit permissions key setting the minimum privileges necessary for the workflow/jobs. The least-privilege starting point for most workflows is:

permissions: contents: read

However, because this workflow uses third-party actions (including Azure/static-web-apps-deploy which uses the repo_token for PR status/comments), it may require additional permissions such as pull-requests: write. The most appropriate and future-safe initial fix is to add, at the root of the workflow (top-level), a permissions section with the minimal rights required:

permissions: contents: read pull-requests: write

This block should be inserted after name: and before on: (i.e., as one of the very top-level keys in the workflow file, so it applies to all jobs). No other files or changes are necessary for a correct and standards-compliant fix.

Copilot

Pull request overview

This PR updates the development environment by modifying deployment workflows and temporarily disabling login functionality in the web portal. The changes appear to be part of work related to feature/52-av-web branch, configuring Azure Static Web Apps deployments for both the SharpEngine Web Portal and Asset Store applications.

Key changes:

Commented out HeaderLogin component usage in the web portal header
Configured Azure Static Web Apps deployment workflows with build and close pull request jobs
Added feature branch triggers to multiple deployment workflows

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 9 comments.

File	Description
Portal/sharpengine-web-ui/src/components/Header.tsx	Temporarily disabled HeaderLogin component by commenting out import and usage
.github/workflows/publish-web.yml	Configured Azure Static Web Apps deployment for SharpEngine Web Portal with build and close PR jobs
.github/workflows/publish-asset-store.yml	Configured Azure Static Web Apps deployment for Asset Store with OIDC authentication and build/close PR jobs
.github/workflows/azure-static-web-apps-victorious-moss-06d128203.yml	Updated workflow to deploy Portal instead of Asset Store and corrected Azure secret reference

Comments suppressed due to low confidence (1)

.github/workflows/azure-static-web-apps-victorious-moss-06d128203.yml:59

The close_pull_request_job is missing the required azure_static_web_apps_api_token parameter. The action will fail without this token. Add the azure_static_web_apps_api_token secret reference similar to the build_and_deploy_job.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2025-12-13T23:01:24Z

.github/workflows/publish-asset-store.yml

+          action: "close"
+


The close_pull_request_job is missing the required azure_static_web_apps_api_token parameter. The action will fail without this token. Add the azure_static_web_apps_api_token secret reference similar to the build_and_deploy_job.

Suggested change

action: "close"

azure_static_web_apps_api_token: ${{ secrets.AZURE_STATIC_WEB_APPS_API_TOKEN_WHITE_SKY_0ACD4AD03 }}

action: "close"

Copilot · 2025-12-13T23:01:25Z

Portal/sharpengine-web-ui/src/components/Header.tsx

+//import { HeaderLogin } from 'sharpengine-ui-shared/src/components/HeaderLogin'

 export function Header() {
  const navigate = useNavigate();


The navigate variable is declared but never used since the HeaderLogin component that uses it has been commented out. Either remove the unused useNavigate import and variable declaration, or if this is temporary, consider using a feature flag approach instead of commenting out code.

Copilot · 2025-12-13T23:01:25Z

Portal/sharpengine-web-ui/src/components/Header.tsx

@@ -1,8 +1,8 @@
 import { useState } from 'react';
 import { useNavigate } from 'react-router-dom';
 import { ChevronDown, User } from 'lucide-react';


The User import from lucide-react is unused. Consider removing it to keep the imports clean and avoid bundle bloat.

Suggested change

import { ChevronDown, User } from 'lucide-react';

import { ChevronDown } from 'lucide-react';

Copilot · 2025-12-13T23:01:25Z

.github/workflows/publish-web.yml

+    #   - main
+      - feature/52-av-web


This workflow is configured to trigger on pushes to a feature branch (feature/52-av-web) rather than the main branch. Feature branches should typically not trigger deployment workflows directly. Consider removing this branch trigger before merging to ensure the workflow only deploys from stable branches.

Suggested change

# - main

- feature/52-av-web

- main

Copilot · 2025-12-13T23:01:25Z

.github/workflows/publish-web.yml

+        id: closepullrequest
+        uses: Azure/static-web-apps-deploy@v1
+        with:
+          azure_static_web_apps_api_token: ${{ secrets.AZURE_STATIC_WEB_APPS_API_TOKEN_KIND_MEADOW_06167BF03 }}


The close_pull_request_job is missing the required azure_static_web_apps_api_token parameter. The action will fail without this token. Add the azure_static_web_apps_api_token secret reference similar to the build_and_deploy_job.

Suggested change

azure_static_web_apps_api_token: ${{ secrets.AZURE_STATIC_WEB_APPS_API_TOKEN_KIND_MEADOW_06167BF03 }}

azure_static_web_apps_api_token: ${{ secrets.AZURE_STATIC_WEB_APPS_API_TOKEN_KIND_MEADOW_06167BF03 }}

azure_static_web_apps_api_token: ${{ secrets.AZURE_STATIC_WEB_APPS_API_TOKEN_KIND_MEADOW_06167BF03 }}

Copilot · 2025-12-13T23:01:26Z

.github/workflows/publish-asset-store.yml

+      - main
+      - feature/52-av-web


This workflow is configured to trigger on pushes to a feature branch (feature/52-av-web). Feature branches should typically not trigger deployment workflows directly. Consider removing this branch trigger before merging to ensure the workflow only deploys from stable branches like main.

Copilot · 2025-12-13T23:01:26Z

.github/workflows/publish-asset-store.yml

    branches:
-      - test
+      - main
+      - feature/52-av-web


This workflow includes a feature branch (feature/52-av-web) in the pull request trigger configuration. Pull request workflows should typically only be configured for stable target branches. Consider removing this feature branch from the configuration.

Suggested change

- feature/52-av-web

Copilot · 2025-12-13T23:01:26Z

Portal/sharpengine-web-ui/src/components/Header.tsx

 import { ChevronDown, User } from 'lucide-react';

-import { HeaderLogin } from 'sharpengine-ui-shared/src/components/HeaderLogin'
+//import { HeaderLogin } from 'sharpengine-ui-shared/src/components/HeaderLogin'


The import statement and component usage for HeaderLogin have been commented out but not removed. If this is a temporary change for testing, consider using a feature flag instead. If this is a permanent removal, the commented code should be deleted to improve code maintainability.

Copilot · 2025-12-13T23:01:26Z

Portal/sharpengine-web-ui/src/components/Header.tsx

        </nav>

-        <HeaderLogin onProfileClicked={() => navigate('/profile')} />
+        {/* <HeaderLogin onProfileClicked={() => navigate('/profile')} /> */}


The HeaderLogin component usage has been commented out but not removed. If this is a temporary change for testing, consider using a feature flag instead. If this is a permanent removal, the commented code should be deleted to improve code maintainability.

sonarqubecloud · 2026-01-04T21:25:38Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

Av3boy and others added 7 commits December 13, 2025 15:39

Merge pull request #120 from Av3boy/dev

d24797a

Dev

#52 Test

fb71099

ci: add Azure Static Web Apps workflow file

8b2d029

on-behalf-of: @Azure opensource@microsoft.com

#52 Test yml (#121)

006ab74

* #52 Temp * #52 Test --------- Co-authored-by: Antti Veikkolainen <antti.veikkolainen00@outlook.com>

ci: add Azure Static Web Apps workflow file

906d83d

on-behalf-of: @Azure opensource@microsoft.com

#52 temp

02b3f62

Test

c163f94

Copilot AI review requested due to automatic review settings December 13, 2025 22:57

github-advanced-security bot found potential problems Dec 13, 2025

View reviewed changes

Av3boy self-assigned this Dec 13, 2025

Copilot started reviewing on behalf of Av3boy December 13, 2025 22:57 View session

Copilot AI reviewed Dec 13, 2025

View reviewed changes

Add shields to readme (#118)

6f5f958

Av3boy closed this Jan 4, 2026

@@ -1,4 +1,7 @@
             name: Publish SharpEngine Web Portal
+            permissions:
+              contents: read
+              pull-requests: write
             on:
               push:

	action: "close"
	azure_static_web_apps_api_token: ${{ secrets.AZURE_STATIC_WEB_APPS_API_TOKEN_WHITE_SKY_0ACD4AD03 }}
	action: "close"

	import { ChevronDown, User } from 'lucide-react';
	import { ChevronDown } from 'lucide-react';

Update dev #122

Update dev #122

Uh oh!

Conversation

Av3boy commented Dec 13, 2025

<Issue number> <Change title>

Contents

Checklist

Uh oh!

Check warning

Copilot Autofix

Check warning

Copilot Autofix

Check warning

Copilot Autofix

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Dec 13, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 13, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 13, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 13, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 13, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 13, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 13, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 13, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 13, 2025

Choose a reason for hiding this comment

Uh oh!

sonarqubecloud bot commented Jan 4, 2026

Quality Gate passed

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants