.github/workflows/check-lab-sdk-version.yml (2)

9-12: Add explicit least‑privilege workflow permissions.
Default token permissions can be broader than needed; this workflow only reads the repo.

🔒 Suggested minimal permissions

 on:
   pull_request:
     paths:
       - "lab-sdk/pyproject.toml"
       - "api/pyproject.toml"

+permissions:
+  contents: read

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.github/workflows/check-lab-sdk-version.yml around lines 9 - 12, The
workflow currently relies on default token permissions; update the workflow to
explicitly grant least-privilege read access by adding a top-level permissions
block (e.g., permissions: contents: read) to the workflow YAML so the
check-version-sync job only has repository read access; locate the jobs:
check-version-sync section and add the permissions key at the workflow root (not
inside the job) to enforce minimal token scope.

---

31-41: Consider Python TOML parsing for maintainability.
The current awk parsing works correctly for the present file structure; however, using tomllib would make the code more explicit and maintainable. TOML is a structured format best parsed with a dedicated library rather than line-based tools, especially if dependency specifiers or other TOML entries evolve over time.

Optional refactor (explicit TOML parsing)

       - name: Checkout repository
         uses: actions/checkout@v4

+      - name: Setup Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+
       - name: Compare lab-sdk and API transformerlab versions
         run: |
           set -euo pipefail
@@
-          # Extract version from lab-sdk/pyproject.toml [project] table
-          sdk_version=$(awk -F '"' '/^\s*version\s*=\s*"/ {print $2; exit}' lab-sdk/pyproject.toml)
+          # Extract versions via TOML parsing
+          read -r sdk_version api_version < <(python - <<'PY'
+import re, tomllib
+from pathlib import Path
+
+sdk = tomllib.loads(Path("lab-sdk/pyproject.toml").read_text())
+api = tomllib.loads(Path("api/pyproject.toml").read_text())
+
+sdk_version = sdk["project"]["version"]
+deps = api["project"]["dependencies"]
+
+api_version = None
+for dep in deps:
+    m = re.match(r"^transformerlab(?:\[.*\])?==(.+)$", dep.strip())
+    if m:
+        api_version = m.group(1)
+        break
+
+print(sdk_version, api_version or "")
+PY
+          )

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.github/workflows/check-lab-sdk-version.yml around lines 31 - 41, Replace
the fragile awk-based extraction of SDK and API versions with a short Python
invocation that uses tomllib to parse lab-sdk/pyproject.toml and
api/pyproject.toml and print the needed fields; specifically, stop using the
sdk_version and api_version awk assignments and instead call a python -c snippet
that opens lab-sdk/pyproject.toml, loads tomllib, reads the
["project"]["version"] into stdout (for sdk_version) and similarly reads the
transformerlab dependency from api/pyproject.toml (parsing the
["project"]["dependencies"] list to extract the entry that starts with
"transformerlab==" and emit the version part) so the shell can capture those
values reliably.