Skip to content

2.7.0 #396

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
danielswiatek merged 2 commits into from
Feb 4, 2026
Merged

2.7.0 #396

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
1a33b0c
chore: update helm-oci-chart-releaser to v0.4.2 and change registry t…
danielswiatek Feb 4, 2026
61222ed
feat: add GitHub Release workflow for automated releases
danielswiatek Feb 4, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 15 additions & 0 deletions .github/workflows/gh-release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,15 @@
name: GitHub Release

on:
push:
tags:
- 'v*.*.*'

jobs:
build:
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v3
- name: Release
uses: softprops/action-gh-release@v1
Comment on lines +10 to +15

Check warning

Code scanning / CodeQL

Workflow does not contain permissions

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {{contents: read}}

Copilot Autofix

AI 23 days ago

In general, to fix this class of problem you add an explicit permissions block either at the top level of the workflow (applies to all jobs) or within the individual job (applies to that job only). The block should grant only the specific scopes required. For a release workflow using softprops/action-gh-release, the main required permission is contents: write so the action can create/update GitHub releases and upload assets. Other scopes (issues, pull-requests, etc.) are not needed here and should remain at their implicit none unless explicitly required.

For this specific file .github/workflows/gh-release.yml, the least intrusive and clearest fix is to add a permissions block to the build job (right under runs-on: ubuntu-latest) specifying contents: write. This avoids changing behavior for any other jobs that might exist elsewhere in the file (we are only shown this one job) and documents the exact permission required for this job. No imports or additional definitions are required; this is purely a YAML configuration change.

Concretely:

  • Edit the build job in .github/workflows/gh-release.yml.
  • Insert the following block after line 10 (runs-on: ubuntu-latest):
    permissions:
      contents: write

This gives the GITHUB_TOKEN only the content write permission needed to create releases, while staying within the principle of least privilege.

Suggested changeset 1
.github/workflows/gh-release.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/gh-release.yml b/.github/workflows/gh-release.yml
--- a/.github/workflows/gh-release.yml
+++ b/.github/workflows/gh-release.yml
@@ -8,6 +8,8 @@
 jobs:
   build:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     steps:
       - name: Checkout
         uses: actions/checkout@v3
EOF
@@ -8,6 +8,8 @@
jobs:
build:
runs-on: ubuntu-latest
permissions:
contents: write
steps:
- name: Checkout
uses: actions/checkout@v3
Copilot is powered by AI and may make mistakes. Always verify output.
10 changes: 5 additions & 5 deletions .github/workflows/helm.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,12 +45,12 @@ jobs:
sed -i "s/commit: .*/commit: ${{ needs.prepare.outputs.commit }}/g" chart/brahmsee-digital/values.yaml

- name: Chart | Push brahmsee-digital
uses: appany/helm-oci-chart-releaser@v0.3.0
uses: appany/helm-oci-chart-releaser@v0.4.2
with:
name: brahmsee-digital
repository: codeanker/brahmsee.digital
repository: codeanker
tag: ${{needs.prepare.outputs.version}}-${{needs.prepare.outputs.commit}}
path: chart/brahmsee-digital
registry: ghcr.io
registry_username: ${{ github.actor }}
registry_password: ${{ secrets.GITHUB_TOKEN }}
registry: docker.io
registry_username: ${{ secrets.DOCKERHUB_USERNAME }}
registry_password: ${{ secrets.DOCKERHUB_TOKEN }}
Loading