Skip to content

ci: trigger dune upload #301

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Xeonus merged 2 commits into from
Mar 3, 2026
Merged

ci: trigger dune upload #301

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
bf16baa
ci: trigger dune upload
gosuto-inzasheru Feb 27, 2026
4939f6a
ci: add empty permissions block to dune upload workflow
gosuto-inzasheru Feb 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 22 additions & 0 deletions .github/workflows/trigger_dune_upload.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,22 @@
name: Trigger Dune Revenue Upload

on:
push:
branches:
- biweekly-runs
paths:
- "fee_allocator/summaries/*.json"

permissions: {}

jobs:
dispatch:
runs-on: ubuntu-latest

steps:
- name: Trigger dune revenue upload
run: |
gh api repos/${{ secrets.DUNE_UPLOAD_REPO }}/dispatches \
-f event_type=recon-updated
env:
GH_TOKEN: ${{ secrets.DUNE_UPLOAD_TOKEN }}
Comment on lines +14 to +22

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {}

Copilot Autofix

AI 7 days ago

In general, the fix is to add an explicit permissions block to the workflow or to individual jobs, restricting the GITHUB_TOKEN to the minimum required scopes. This prevents the job from inheriting broad default permissions and documents the intended access level.

For this specific workflow, the dispatch job only invokes gh api using a separate GH_TOKEN from secrets.DUNE_UPLOAD_TOKEN and does not reference GITHUB_TOKEN. The minimal, non-breaking change is to add a job-level permissions block under jobs.dispatch that limits GITHUB_TOKEN to read-only repository contents. A safe common baseline is:

permissions:
  contents: read

This should be inserted directly under jobs.dispatch: (around current line 12) and indented to align with runs-on:. No additional imports or methods are needed, since this is purely a workflow configuration change.

Suggested changeset 1
.github/workflows/trigger_dune_upload.yaml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/trigger_dune_upload.yaml b/.github/workflows/trigger_dune_upload.yaml
--- a/.github/workflows/trigger_dune_upload.yaml
+++ b/.github/workflows/trigger_dune_upload.yaml
@@ -9,6 +9,8 @@
 
 jobs:
   dispatch:
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
 
     steps:
EOF
@@ -9,6 +9,8 @@

jobs:
dispatch:
permissions:
contents: read
runs-on: ubuntu-latest

steps:
Copilot is powered by AI and may make mistakes. Always verify output.
Unable to commit as this autofix suggestion is now outdated
Copy link
Contributor

@Xeonus Xeonus Feb 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe just add read perms?