imbajin commented on code in PR #787:
URL:
https://github.com/apache/hugegraph-toolchain/pull/787#discussion_r4203249118
##########
.github/workflows/ci.yml:
##########
@@ -188,6 +187,10 @@ jobs:
java-version: '17'
client:
+ permissions:
+ contents: read
+ actions: read
+ id-token: write
Review Comment:
⚠️ Important: This adds job-wide `id-token: write` to Client, and the Loader
and Hubble jobs repeat it. Their reusable workflows run PR-controlled
compilation and tests before the Codecov upload, so token requests are
available before the intended consumer. Please move coverage upload into a
dedicated OIDC-enabled job and keep this permission off the build/test jobs.
Evidence: [GitHub OIDC
reference](https://docs.github.com/en/actions/reference/security/oidc)
documents job-level token permission and runner token-request variables.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
