Skip to content

ci: annotate the lockfix permissions with sentinel accepts #144

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
bgard68 merged 1 commit into from
Aug 25, 2026
+2 −13
Merged

ci: annotate the lockfix permissions with sentinel accepts #144

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 2 additions & 13 deletions .github/workflows/dependabot-lockfix.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,11 +44,9 @@ on:
required: true
type: string

# Read-only at the workflow level, so any job added to this file starts with nothing. The two
# write scopes belong to the single job below and are declared there, next to the steps that
# need them.
permissions:
contents: read
contents: write # sentinel:accept GHA002 - pushes the regenerated lock files to the Dependabot branch
actions: write # sentinel:accept GHA002 - approves the PR checks GitHub creates after the bot push

concurrency:
group: dependabot-lockfix-${{ github.event.workflow_run.head_branch || inputs.branch }}
Expand All @@ -67,15 +65,6 @@ jobs:
runs-on: ubuntu-latest
timeout-minutes: 10

# Both scopes are load-bearing, and each is used by exactly one step below:
# contents: write -> "Push the fix if anything changed" (git push origin HEAD:$BRANCH)
# actions: write -> "Approve the pull-request checks on the fixed commit"
# (POST /repos/{repo}/actions/runs/{id}/approve)
# Dropping either one breaks the repair this workflow exists to perform.
permissions:
contents: write
actions: write

env:
BRANCH: ${{ github.event.workflow_run.head_branch || inputs.branch }}

Expand Down