-
Notifications
You must be signed in to change notification settings - Fork 0
Sentry improvements #241
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: master
Are you sure you want to change the base?
Sentry improvements #241
Changes from all commits
7f274a8
e6315db
2d7b8bb
2ca37ac
abb3ed5
f286e5f
bbe61f2
b997f09
9193ebc
0174d12
a950747
d5d403a
46a1b1e
6f293d2
9705fe2
6d8c0b7
076777d
39c43b4
8c68ddb
db11fb9
baf782a
baf5a2f
24c48eb
8baa0e9
0b717c9
3e31ba3
046cd41
e6045b3
168f2ab
cb837bf
06ccd93
9bd475b
7b443a5
1b22e92
1d832ca
1bea2bc
6294874
1915424
3493ca3
753cfa5
e4d2a9f
d95ebe7
a24b87d
06a07ec
8424b91
222883d
edc5b74
a22370c
0cd06bb
92ae5b6
30077a9
afe593d
5b3e5a5
05c67dd
2a23346
a823c0c
79c8f6a
f644f4e
9b16683
11e269c
3ecf0eb
c632cc1
bc92bbb
24bf09c
b97f2c8
f1eaefd
47b7122
af1fdf3
b0d934f
e5f8f17
9c21a36
68bd9f9
ed7868d
0e533f0
caded95
4021ed8
bce4a6c
7fa37c8
598aad3
a873ad2
f699a88
e1702f7
af37054
f1a72b9
8029458
7b06148
712a773
c0dd75a
fa63cc1
29f8ad1
75e83f2
ac0a474
17f18a1
6837b6c
e2aa65d
71b6b9e
a4b7875
0627388
cc31dff
1d468df
0cc3aa5
4c60400
bc98231
7f7905e
39ef5aa
42a543d
6508af7
01a0e40
fa8734b
17c6645
6f8c141
0b0f74d
029f140
f6c8388
190d6e3
247adfd
635e37f
e14519e
d564a59
782c5e3
452f69f
e8ff9f9
cb211ee
bdebb83
c2f4662
4f7bbe8
30d955d
71c2500
4c0c45c
f3faa4d
d502a2c
7e62b76
5c2664b
c829cc3
76ae67e
cb0d7ef
7ab8e7e
618761b
df34804
bc31e12
a93d2d3
9f5ef19
05a5591
adad505
8cdb531
922e6d4
0d6e811
5b91912
0be0e37
6d4a0ac
6353590
4838e16
6d510c4
9c80f5b
dde134a
32af252
5e9bdb6
8c0ca7a
7700172
f042bda
3db4927
03194ac
60e03d0
3cf9d40
804b42a
1794370
109f11c
4f6f66b
967be11
f086c38
58b7a6b
5df8c76
e3b0a1b
7af1b7b
257cd95
0ec00c4
a1c6149
5095a4b
998a43a
61e01f2
1188ab7
4e3dfcc
c67f5f3
87a6fa8
1d7e538
16a68d7
a72ccdf
fb914ac
746217c
b444006
5262709
51402d8
af3a33b
1b6a309
5cc0ee2
9a48e46
81feb98
5dbac00
fc934f9
48ed127
c4871e7
1b1a6d9
547de3b
fd3ce82
db4fad4
38d6716
d2c94e2
935f277
c6b9ada
9ad56bc
83ba96e
8e4ce7f
2e674dd
4e5bd60
85b4752
1bb9c97
54d14f0
c6dbf2c
efe2c8f
0cbb726
64d7326
7a379f6
3762fa3
bb767d5
21e8a2a
8858976
a028bdc
5064a9f
f63a05d
9d3dae4
4b9f96b
981d37d
8356eea
69855c9
b95864b
8d0dc5d
e9d50f3
f298793
7e94b50
5f3b6df
776d15d
b50d9ac
d01cdc5
fe4e248
a6e8b0d
ea6253f
37e1652
bd62d64
9bee794
330c7e8
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,10 @@ | ||
| # Copy this file to .env, then fill it in with credentials. | ||
| # For stages other than sandbox/dev E.g when requiring Connect Non-prod AWS userpool. | ||
| # Copy this file to .<stage>.env and fill it with stage specific values. | ||
|
|
||
| # cer-graphql variables | ||
| CONTENTFUL_ACCESS_TOKEN= | ||
| CONTENTFUL_SPACE_ID= | ||
| CONTENTFUL_ENVIRONMENT_ID= | ||
| COGNITO_REGION= | ||
| COGNITO_USER_POOL= |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,39 @@ | ||
| version: 2 | ||
| updates: | ||
| - package-ecosystem: 'npm' | ||
| directory: '/research-hub-web' | ||
| schedule: | ||
| interval: 'weekly' | ||
| open-pull-requests-limit: 1 | ||
| reviewers: | ||
| - rosemcc | ||
| - Trombach | ||
| allow: | ||
| - dependency-type: 'direct' | ||
| - package-ecosystem: 'npm' | ||
| directory: '/cer-graphql' | ||
| schedule: | ||
| interval: 'weekly' | ||
| open-pull-requests-limit: 1 | ||
| reviewers: | ||
| - uoa-noel | ||
| allow: | ||
| - dependency-type: 'direct' | ||
| - package-ecosystem: 'npm' | ||
| directory: '/hub-search-proxy' | ||
| schedule: | ||
| interval: 'weekly' | ||
| open-pull-requests-limit: 1 | ||
| reviewers: | ||
| - rosemcc | ||
| allow: | ||
| - dependency-type: 'direct' | ||
| - package-ecosystem: 'npm' | ||
| directory: '/subhub-link-checker' | ||
| schedule: | ||
| interval: 'weekly' | ||
| open-pull-requests-limit: 1 | ||
| reviewers: | ||
| - uoa-noel | ||
| allow: | ||
| - dependency-type: 'direct' |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,20 @@ | ||
| ## Description | ||
| <!--- Describe the feature or bug fix that this PR addresses --> | ||
| <!--- Feature: Attach wireframes or link to relevant design documentation if applicable --> | ||
| <!--- Bug fix: Describe the root cause and analysis of the problem --> | ||
|
|
||
| ## Solution | ||
| <!--- Feature: Describe your code changes, and mention if any existing features/functionality is affected by the changes. --> | ||
| <!--- Bug Fix: Describe your code changes, and explain the technical solution and how it fixes the issue --> | ||
|
|
||
| ## Screenshots | ||
| <!--- Add before and after screenshots of the UI if applicable --> | ||
|
|
||
| ## Testing | ||
| <!--- Describe unit or e2e tests if they were required for this feature/fix --> | ||
|
|
||
| ## Have the changes been checked in the following browsers? | ||
| - [x] Chrome | ||
| - [x] Safari | ||
| - [x] Firefox | ||
| - [x] Edge |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,36 @@ | ||
| name: Lint | ||
|
|
||
| on: | ||
| # Trigger the workflow on push or pull request, | ||
| # but only for the main branch | ||
| push: | ||
| branches: | ||
| - master | ||
| pull_request: | ||
| branches: | ||
| - master | ||
|
|
||
| jobs: | ||
| run-linters: | ||
| name: Run linters | ||
| runs-on: ubuntu-latest | ||
|
|
||
| steps: | ||
| - name: Check out Git repository | ||
| uses: actions/checkout@v2 | ||
|
|
||
| - name: Set up Node.js | ||
| uses: actions/setup-node@v1 | ||
| with: | ||
| node-version: 14 | ||
|
|
||
| - name: Install Node.js dependencies | ||
| working-directory: ./research-hub-web | ||
| run: npm ci | ||
|
|
||
| - name: Install Angular CLI | ||
| run: npm install -g @angular/cli | ||
|
|
||
| - name: ng lint | ||
| working-directory: ./research-hub-web | ||
| run: ng lint | ||
| Original file line number | Diff line number | Diff line change | |||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| @@ -0,0 +1,33 @@ | |||||||||||||||||||||||||||||
| name: Sentry Release | |||||||||||||||||||||||||||||
|
|
|||||||||||||||||||||||||||||
| on: | |||||||||||||||||||||||||||||
| push: | |||||||||||||||||||||||||||||
| branches: | |||||||||||||||||||||||||||||
| - dev | |||||||||||||||||||||||||||||
| - test | |||||||||||||||||||||||||||||
| - prod | |||||||||||||||||||||||||||||
| paths: | |||||||||||||||||||||||||||||
| - 'research-hub-web/**' | |||||||||||||||||||||||||||||
|
|
|||||||||||||||||||||||||||||
| jobs: | |||||||||||||||||||||||||||||
| sentry-release: | |||||||||||||||||||||||||||||
| name: Create Sentry Release | |||||||||||||||||||||||||||||
| runs-on: ubuntu-latest | |||||||||||||||||||||||||||||
|
|
|||||||||||||||||||||||||||||
| steps: | |||||||||||||||||||||||||||||
| - name: Check out Git repository | |||||||||||||||||||||||||||||
| uses: actions/checkout@v2 | |||||||||||||||||||||||||||||
| - name: Get Branch | |||||||||||||||||||||||||||||
| id: var | |||||||||||||||||||||||||||||
| run: echo ::set-output name=branch::${GITHUB_REF#refs/*/} | |||||||||||||||||||||||||||||
| - name: Output Branch | |||||||||||||||||||||||||||||
| run: echo ${{ steps.var.outputs.branch }} | |||||||||||||||||||||||||||||
| - name: Notify Sentry | |||||||||||||||||||||||||||||
| # https://github.com/getsentry/action-release | |||||||||||||||||||||||||||||
| uses: getsentry/action-release@v1.1.6 | |||||||||||||||||||||||||||||
Check warningCode scanning / CodeQL Unpinned tag for a non-immutable Action in workflow Medium
Unpinned 3rd party Action 'Sentry Release' step
Uses Step Error loading related location Loading |
|||||||||||||||||||||||||||||
| env: | |||||||||||||||||||||||||||||
| SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }} | |||||||||||||||||||||||||||||
| SENTRY_ORG: university-of-auckland-7o | |||||||||||||||||||||||||||||
| SENTRY_PROJECT: research-hub | |||||||||||||||||||||||||||||
| with: | |||||||||||||||||||||||||||||
| environment: ${{ steps.var.outputs.branch }} | |||||||||||||||||||||||||||||
|
Comment on lines
+14
to
+33
Check warningCode scanning / CodeQL Workflow does not contain permissions Medium
Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read}
Copilot AutofixAI 20 days ago In general, fix this by explicitly configuring The best minimal fix without changing functionality is to add a permissions:
contents: readNo additional methods, imports, or other definitions are required; this is purely a configuration hardening change to the workflow YAML.
Suggested changeset
1
.github/workflows/sentry.yml
Copilot is powered by AI and may make mistakes. Always verify output.
Refresh and try again.
|
|||||||||||||||||||||||||||||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,37 @@ | ||
| { | ||
| // Use IntelliSense to learn about possible attributes. | ||
| // Hover to view descriptions of existing attributes. | ||
| // For more information, visit: https://go.microsoft.com/fwlink/?linkid=830387 | ||
| "version": "0.2.0", | ||
| "configurations": [ | ||
| { | ||
| "type": "pwa-chrome", | ||
| "request": "launch", | ||
| "name": "Launch Chrome against localhost", | ||
| "preLaunchTask": "research-hub-web - start", | ||
| "url": "http://localhost:4200", | ||
| "webRoot": "${workspaceFolder}/research-hub-web/" | ||
| }, | ||
| { | ||
| "name": "Attach to Firefox", | ||
| "type": "firefox", | ||
| "request": "attach", | ||
| "url": "http://localhost:4200/", | ||
| "webRoot": "${workspaceFolder}/research-hub-web/", | ||
| "preLaunchTask": "research-hub-web - start" | ||
| }, | ||
| { | ||
| "type": "pwa-chrome", | ||
| "request": "attach", | ||
| "name": "Attach to Karma", | ||
| "address": "localhost", | ||
| "port": 9222, | ||
| "timeout": 600000, | ||
| "sourceMaps": true, | ||
| "webRoot": "${workspaceFolder}/research-hub-web/", | ||
| "pathMapping": { | ||
| "/_karma_webpack_": "${workspaceFolder}/research-hub-web/" | ||
| } | ||
| } | ||
| ] | ||
| } |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,114 @@ | ||
| { | ||
| "version": "2.0.0", | ||
| "tasks": [ | ||
| { | ||
| "type": "npm", | ||
| "script": "start", | ||
| "path": "research-hub-web/", | ||
| "label": "research-hub-web - start", | ||
| "group": "build", | ||
| "dependsOrder": "sequence", | ||
| "dependsOn": ["research-hub-web - run GraphQL server"], | ||
| "presentation": { | ||
| "group": "web" | ||
| }, | ||
| "isBackground": true, | ||
| "problemMatcher": { | ||
| "owner": "custom", | ||
| "fileLocation": ["relative", "${workspaceFolder}"], | ||
| "pattern":[{ | ||
| // TODO Stub pattern, doesn't actually match problems. | ||
| // Added as it's required | ||
| "regexp": "^([^\\\\s].*)\\\\((\\\\d+,\\\\d+)\\\\):\\\\s*(.*)$", | ||
| "file": 1, | ||
| "location": 2, | ||
| "message": 3 | ||
| }], | ||
| "background": { | ||
| "activeOnStart": true, | ||
| "beginsPattern": "^.*Generating browser application bundles", | ||
| "endsPattern": "^.*Angular Live Development Server is listening on.*" | ||
| } | ||
| }, | ||
| }, | ||
| { | ||
| "type": "npm", | ||
| "script": "graphql-server-watch", | ||
| "path": "research-hub-web/", | ||
| "problemMatcher": { | ||
| "owner": "custom", | ||
| "fileLocation": ["relative", "${workspaceFolder}"], | ||
| "pattern":[{ | ||
| // TODO Stub pattern, doesn't actually match problems. | ||
| // Added as it's required | ||
| "regexp": "^([^\\\\s].*)\\\\((\\\\d+,\\\\d+)\\\\):\\\\s*(.*)$", | ||
| "file": 1, | ||
| "location": 2, | ||
| "message": 3 | ||
| }], | ||
| "background": { | ||
| "beginsPattern": "Loading remote schema...", | ||
| "endsPattern": "^.*Content API server ready.*$" | ||
| } | ||
| }, | ||
| "label": "research-hub-web - run GraphQL server", | ||
| "presentation": { | ||
| "group": "web" | ||
| }, | ||
| "isBackground": true | ||
| }, | ||
| { | ||
| "type": "npm", | ||
| "script": "generate-watch", | ||
| "path": "research-hub-web/", | ||
| "problemMatcher": { | ||
| "owner": "custom", | ||
| "fileLocation": ["relative", "${workspaceFolder}"], | ||
| "pattern":[{ | ||
| // TODO Stub pattern, doesn't actually match problems. | ||
| // Added as it's required | ||
| "regexp": "^([^\\\\s].*)\\\\((\\\\d+,\\\\d+)\\\\):\\\\s*(.*)$", | ||
| "file": 1, | ||
| "location": 2, | ||
| "message": 3 | ||
| }], | ||
| "background": { | ||
| "beginsPattern": "^.*Parse configuration", | ||
| "endsPattern": "^.*Watching for changes..." | ||
| } | ||
| }, | ||
| "label": "research-hub-web - generate GraphQL types", | ||
| "presentation": { | ||
| "group": "web" | ||
| }, | ||
| "isBackground": true | ||
| }, | ||
| { | ||
| "type": "npm", | ||
| "script": "test-watch", | ||
| "path": "research-hub-web/", | ||
| "problemMatcher": { | ||
| "owner": "custom", | ||
| "fileLocation": ["relative", "${workspaceFolder}"], | ||
| "pattern":[{ | ||
| // TODO Stub pattern, doesn't actually match problems. | ||
| // Added as it's required | ||
| "regexp": "^([^\\\\s].*)\\\\((\\\\d+,\\\\d+)\\\\):\\\\s*(.*)$", | ||
| "file": 1, | ||
| "location": 2, | ||
| "message": 3 | ||
| }], | ||
| "background": { | ||
| "beginsPattern": "^.*Generating browser application bundles", | ||
| "endsPattern": "^.*Coverage summary" | ||
| } | ||
| }, | ||
| "label": "research-hub-web - test", | ||
| "presentation": { | ||
| "group": "web" | ||
| }, | ||
| "isBackground": true | ||
| } | ||
|
|
||
| ] | ||
| } |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Copilot Autofix
AI 20 days ago
To fix the problem, explicitly restrict
GITHUB_TOKENpermissions in the workflow to the minimal scope required. This workflow only needs to read repository contents to check out and lint the code, socontents: readis sufficient. We can set this at the workflow (root) level so it applies to all jobs, or at the job level. Since there is only one job, either is fine, but using a top‑levelpermissionsblock best documents the workflow’s intent and secures any future jobs by default.Concretely, in
.github/workflows/linting.yml, add apermissions:block near the top, at the same indentation level ason:andjobs:. For example:No imports or external libraries are needed; this is purely a YAML configuration change within the workflow file and does not alter the existing functional behavior of the linting steps.