chore(ci): converge go-ci reusable to v2.6.6#88
Conversation
Pin go-ci.yml 7c1302bdef0a72e7f5743738baa45272c8e1f8d7 -> 9391f462483f0ca025fbbb57bfb0f9f9561e1b6a (v2.6.6). Content delta vs the stale pins: golangci-lint v2.11.4->v2.12.2, preflight pull-requests:read permission (PR #61), and script-injection hardening (github context moved to env vars). No change to go test/build/vet or gates. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
Codex review skipped — non-code PR (only changed files matching |
|
Gemini review skipped — non-code PR (only changed files matching |
|
Claude review skipped — non-code PR (only changed files matching |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 9672daf07e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| jobs: | ||
| ci: | ||
| uses: praetorian-inc/public-workflows/.github/workflows/go-ci.yml@7c1302bdef0a72e7f5743738baa45272c8e1f8d7 # v2.1.0 | ||
| uses: praetorian-inc/public-workflows/.github/workflows/go-ci.yml@9391f462483f0ca025fbbb57bfb0f9f9561e1b6a # v2.6.6 |
There was a problem hiding this comment.
The v2.6.6 reusable now has a preflight job that declares pull-requests: read and calls gh api repos/$REPO/pulls/$PR_NUMBER/files, but this caller job still passes only contents: read; GitHub reusable workflows cannot elevate the GITHUB_TOKEN permissions they receive from the caller, and omitted scopes are none, so the next PR with Go-relevant changes will fail before lint/test/build instead of running CI. Add pull-requests: read to this ci job's permissions when moving to this pin.
Useful? React with 👍 / 👎.
1 participant
Converges the
go-ci.ymlreusable pin to9391f462483f0ca025fbbb57bfb0f9f9561e1b6a(v2.6.6), the current canonical tag.Content delta vs the stale pin: golangci-lint
v2.11.4 → v2.12.2, preflightpull-requests: readpermission (public-workflows#61), and script-injection hardening (github context → env vars). No change togo test/build/vet, golangci invocation, or job gating.Note: the newer linter (v2.12.2) applies on the next code PR (this pin-only PR skips go-ci — no Go files changed). Pin
golangci-lint-version: v2.11.4via the reusable input if you need to defer.🤖 Generated with Claude Code