Skip to content

chore: Added notify-changelog workflow #1532

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
arjankowski merged 1 commit into from
Oct 24, 2025
Merged

chore: Added notify-changelog workflow #1532

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 27 additions & 0 deletions .github/workflows/notify-changelog.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,27 @@
# A GitHub action that notifies the developer
# changelog repository of any new releases.

name: Notify changelog

on:
# Only trigger for a full release,
# ignoring pre-releases and drafts
release:
types:
- released

jobs:
notify:
# This job can run on the latest Ubuntu
# and it should not take more than 3 minutes
runs-on: ubuntu-latest
timeout-minutes: 3

steps:
- name: Notify changelog of new release
uses: peter-evans/repository-dispatch@v1
with:
token: ${{ secrets.DISPATCH_ACCESS_TOKEN }}
repository: box/box-developer-changelog
event-type: new-release-note
client-payload: '{"ref": "${{ github.ref }}", "repository": "${{github.repository}}", "labels": "sdks,java", "repo_display_name": "Box Java SDK"}'
Comment on lines +17 to +27

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {}

Copilot Autofix

AI 3 months ago

The best fix is to explicitly restrict the GITHUB_TOKEN permissions at the earliest reasonable scope. In this workflow, that can be at the workflow level (root), or job level (notify). Given there is only one job, placing it at the workflow level for clarity is the most future-proof for potential additional jobs. Since this workflow appears to notify an external repository using the repository-dispatch action, only contents: read is required for most cases (access to the repository's contents). As the action is provided a personal access token via ${{ secrets.DISPATCH_ACCESS_TOKEN }} and does not use the default GITHUB_TOKEN for dispatch, it likely needs no special write rights at all. Therefore, set permissions: contents: read at the workflow root, granting the minimum access needed.

  • Add, after the name: line and before on:, in .github/workflows/notify-changelog.yml: 
    permissions:
  contents: read
Suggested changeset 1
.github/workflows/notify-changelog.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/notify-changelog.yml b/.github/workflows/notify-changelog.yml
--- a/.github/workflows/notify-changelog.yml
+++ b/.github/workflows/notify-changelog.yml
@@ -2,6 +2,8 @@
 # changelog repository of any new releases.
 
 name: Notify changelog
+permissions:
+  contents: read
 
 on:
   # Only trigger for a full release,
EOF
@@ -2,6 +2,8 @@
# changelog repository of any new releases.

name: Notify changelog
permissions:
contents: read

on:
# Only trigger for a full release,
Copilot is powered by AI and may make mistakes. Always verify output.