Skip to content

fix(codeql): workflow permission and javascript prototype#459

Merged
bzp2010 merged 1 commit into
mainfrom
bzp/fix-codeql-260617
Jun 17, 2026
Merged

fix(codeql): workflow permission and javascript prototype#459
bzp2010 merged 1 commit into
mainfrom
bzp/fix-codeql-260617

Conversation

@bzp2010

@bzp2010 bzp2010 commented Jun 16, 2026 •
edited by coderabbitai Bot
Loading

Copy link
Copy Markdown
Collaborator

Description

Fix code scanning.

Checklist

  • I have explained the need for this PR and the problem it solves
  • I have explained the changes or the new features added to this PR
  • I have added tests corresponding to this change
  • I have updated the documentation to reflect this change
  • I have verified that this change is backward compatible

Summary by CodeRabbit

Release Notes

  • Bug Fixes

    • Fixed configuration merging to prevent reserved property names from being incorrectly merged into resource objects.

  • Chores

    • Updated GitHub Actions workflows to explicitly define job-level permissions for enhanced security and proper functionality of release and deployment processes.

@coderabbitai

coderabbitai Bot commented Jun 16, 2026 •
edited
Loading

Copy link
Copy Markdown

Review Change Stack

📝 Walkthrough

Walkthrough

Three GitHub Actions workflows receive explicit job-level permissions blocks: the two release jobs gain contents: write for asset uploads, while the unit-test and S3/CloudFront deploy jobs are restricted to contents: read. In differv3.ts, mergeDefault adds a one-line guard skipping __proto__, constructor, and prototype keys. In utils.ts, a LGTM suppression comment is added to the existing rejectUnauthorized: false option.

Changes

GitHub Actions Workflow Permission Hardening

Layer / File(s) Summary
Release jobs: contents: write
.github/workflows/release.yaml		 Both adc and adc-macos jobs receive a permissions block granting contents: write, required to upload release assets on tag-triggered runs.
Unit test and S3 deploy jobs: contents: read
.github/workflows/unit.yaml, .github/workflows/update-s3-and-cloudfront.yaml		 Both jobs receive a permissions block explicitly restricting contents access to read.

Source Code Security Fixes

Layer / File(s) Summary
Prototype pollution guard + LGTM annotation
libs/differ/src/differv3.ts, libs/backend-api7/e2e/support/utils.ts		 mergeDefault skips merging entries whose key is __proto__, constructor, or prototype. generateHTTPSAgent adds an inline lgtm[js/disabling-certificate-validation] comment on the existing rejectUnauthorized: false option.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~5 minutes

🚥 Pre-merge checks | ✅ 5 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name Status Explanation Resolution
E2e Test Quality Review ❓ Inconclusive The custom check requests "E2E Test Quality Review," but this PR contains no E2E test changes—only GitHub Actions workflow permissions and a security fix in a utility module. This check is not applicable: the PR fixes code scanning issues (workflow permissions, prototype pollution), not E2E tests. The custom check should be applied to PRs that modify E2E test files.
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Security Check ✅ Passed PR addresses CodeQL scanning issues: (1) Adds proper workflow permissions (read/write) to prevent unintended access; (2) Prevents prototype pollution attacks by filtering proto, constructor, pr...
Title check ✅ Passed The title accurately reflects the main changes: fixing GitHub Actions workflow permissions across three workflows and addressing JavaScript prototype pollution in differv3.ts.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch bzp/fix-codeql-260617

Comment @coderabbitai help to get the list of available commands and usage tips.

github-advanced-security[bot]
github-advanced-security AI found potential problems Jun 16, 2026
View reviewed changes
Comment thread libs/backend-api7/e2e/support/utils.ts Dismissed
@bzp2010 bzp2010 changed the title fix(codeql): workflow permission and ts prototype fix(codeql): workflow permission and javascript prototype Jun 16, 2026
@bzp2010
bzp2010 merged commit 4f06782 into main Jun 17, 2026
32 checks passed
@bzp2010
bzp2010 deleted the bzp/fix-codeql-260617 branch June 17, 2026 03:09
@coderabbitai coderabbitai Bot mentioned this pull request Jun 19, 2026
Open
23 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@juzhiyuan juzhiyuan juzhiyuan approved these changes
+1 more reviewer
@github-advanced-security github-advanced-security[bot] github-advanced-security[bot] left review comments
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@bzp2010 @juzhiyuan @github-advanced-security