Skip to content

Fix/token permissions id 20260911 - #63

Merged
hyperpolymath merged 7 commits into
mainfrom
fix/token-permissions-id-20260911
Sep 13, 2026
Merged

hyperpolymath merged 7 commits into
mainfrom
fix/token-permissions-id-20260911

Conversation

@hyperpolymath

Copy link
Copy Markdown
Owner

Summary

Changes

RSR Quality Checklist

Required

  • Tests pass (just test or equivalent)
  • Code is formatted (just fmt or equivalent)
  • Linter is clean (no new warnings or errors)
  • No banned language patterns (no TypeScript, no npm/bun, no Go/Python)
  • No unsafe blocks without // SAFETY: comments
  • No banned functions (believe_me, unsafeCoerce, Obj.magic, Admitted, sorry)
  • SPDX license headers present on all new/modified source files
  • No secrets, credentials, or .env files included

As Applicable

  • .machine_readable/STATE.a2ml updated (if project state changed)
  • .machine_readable/ECOSYSTEM.a2ml updated (if integrations changed)
  • .machine_readable/META.a2ml updated (if architectural decisions changed)
  • Documentation updated for user-facing changes
  • TOPOLOGY.md updated (if architecture changed)
  • CHANGELOG or release notes updated
  • New dependencies reviewed for license compatibility (MPL-2.0 / MPL-2.0)
  • ABI/FFI changes validated (src/interface/abi/ and src/interface/ffi/ consistent)

Testing

Screenshots

hyperpolymath and others added 6 commits July 26, 2026 14:48
Removing rust-ci.yml workflow since this repository has no Rust code
(Cargo.toml not present). The reusable rust-ci-reusable.yml already guards
itself by detecting Cargo.toml presence, but repos without Rust code
shouldn't trigger unnecessary workflow runs.

Generated by Mistral Vibe.
Co-Authored-By: Mistral Vibe <vibe@mistral.ai>
Apply principle of least privilege for GITHUB_TOKEN:
- Change top-level permissions to read-only
- Jobs inherit read permissions, can escalate as needed

This resolves Scorecard TokenPermissionsID alerts.

Generated by Mistral Vibe.
Co-Authored-By: Mistral Vibe <vibe@mistral.ai>
- Add Optimus-Branch.json for branch protection
- Add Immutable-Tags.json for tag protection
- Remove deprecated branches: from settings.yml
- Keep labels and repository metadata

Generated by Mistral Vibe.
Co-Authored-By: Mistral Vibe <vibe@mistral.ai>
@coderabbitai

coderabbitai Bot commented Sep 12, 2026 •

Copy link
Copy Markdown
Contributor

Review Change StackReview Change Stack

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 217d959c-783d-4730-8bea-1bee8823059f

📥 Commits

Reviewing files that changed from the base of the PR and between 1eb7bff and e1316ba.

📒 Files selected for processing (7)
  • .github/rulesets/Immutable-Tags.json
  • .github/rulesets/Optimus-Branch.json
  • .github/settings.yml
  • .github/workflows/dependabot-automerge.yml
  • .github/workflows/push-email-notify.yml
  • .github/workflows/rhodibot.yml
  • .github/workflows/rust-ci.yml

📝 Summary

Summary by CodeRabbit

  • Security

    • Added stricter protections for tags and the default branch, including signed commits, review requirements, status checks and restrictions on deletion or force updates.
    • Reduced automation permissions to limit write access and granted read access where required for workflow operations.
  • Chores

    • Removed the previous branch protection configuration and the Rust CI workflow.
    • Added read access for GitHub Actions resources to email notification automation.

Walkthrough

The pull request adds repository rulesets, changes GitHub Actions permissions, removes the previous main branch protection block, and deletes the Rust CI workflow.

Changes

Repository governance and workflow controls

Layer / File(s) Summary
Repository ruleset enforcement
.github/rulesets/*.json, .github/settings.yml
Adds active tag and default-branch rulesets. Removes the previous main branch protection configuration.
Workflow permission scopes
.github/workflows/dependabot-automerge.yml, .github/workflows/push-email-notify.yml, .github/workflows/rhodibot.yml
Changes workflow token permissions. Dependabot and Rhodibot use contents: read; push email notifications use actions: read.
Rust CI workflow removal
.github/workflows/rust-ci.yml
Removes the Rust CI triggers, permissions, and reusable workflow job.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Bug fix

✨ Finishing Touches 💡 1
🛠️ Fix failing CI checks 💡
  • Create stacked PR
  • Commit on current branch

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

A rabbit checks the tags at night
Signed commits hop into sight
Branch rules guard the central tree
Smaller tokens grant less key
Rust CI rests beneath the moon

Comment @coderabbitai help to get the list of available commands.

@hyperpolymath
hyperpolymath merged commit 4a8e59e into main Sep 13, 2026
11 of 17 checks passed
@hyperpolymath
hyperpolymath deleted the fix/token-permissions-id-20260911 branch September 13, 2026 21:30
@sonarqubecloud

Copy link
Copy Markdown

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants