Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions .github/workflows/slash_command_dispatch.yml
Original file line number Diff line number Diff line change
Expand Up @@ -34,6 +34,7 @@ jobs:
fix-pr
test-pr
poetry-lock
tune-slow-markers
static-args: |
pr=${{ github.event.issue.number }}
comment-id=${{ github.event.comment.id }}
Expand Down
79 changes: 79 additions & 0 deletions .github/workflows/tune-slow-markers-command.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,79 @@
name: Tune Slow Markers Command

on:
repository_dispatch:
types: [tune-slow-markers-command]

env:
AIRBYTE_ANALYTICS_ID: ${{ vars.AIRBYTE_ANALYTICS_ID }}

jobs:
tune-slow-markers:
name: Tune Slow Markers
runs-on: ubuntu-latest
steps:
- name: Checkout PR branch
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
token: ${{ secrets.GITHUB_TOKEN }}
repository: ${{ github.event.client_payload.pull_request.head.repo.full_name }}
ref: ${{ github.event.client_payload.pull_request.head.ref }}
Comment on lines +11 to +20
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛠️ Refactor suggestion | 🟠 Major

Add explicit permissions block to the workflow?

CodeQL flagged that this workflow doesn't limit the permissions of GITHUB_TOKEN. Since this workflow needs to commit and push changes (line 55), would you consider adding an explicit permissions block at the job level? Something like:

 jobs:
   tune-slow-markers:
     name: Tune Slow Markers
     runs-on: ubuntu-latest
+    permissions:
+      contents: write  # For git push
+      pull-requests: write  # For commenting on PRs
+      issues: write  # For reacting to comments
     steps:

This follows the principle of least privilege and makes the required permissions explicit. Wdyt?

Committable suggestion skipped: line range outside the PR's diff.

🤖 Prompt for AI Agents
In .github/workflows/tune-slow-markers-command.yml around lines 11 to 20 the job
does not declare explicit GITHUB_TOKEN permissions; add a job-level permissions
block granting only the minimum required permission to push commits (e.g.,
permissions: contents: write) directly under the tune-slow-markers job header so
the workflow can commit/push while following least-privilege practices.


- name: Install uv
uses: astral-sh/setup-uv@v4
with:
enable-cache: true

- name: Set up Python
uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
with:
python-version: '3.10'

- name: Run slow marker tuner
run: |
uv run bin/tune_slow_markers.py --timeout 7.0 --remove-slow

- name: Check for changes
id: check_changes
run: |

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📝 [actionlint] reported by reviewdog 🐶
shellcheck reported issue in this script: SC2086:info:2:26: Double quote to prevent globbing and word splitting [shellcheck]

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📝 [actionlint] reported by reviewdog 🐶
shellcheck reported issue in this script: SC2086:info:4:27: Double quote to prevent globbing and word splitting [shellcheck]

if [[ -n $(git status --porcelain) ]]; then
echo "changes=true" >> $GITHUB_OUTPUT
else
echo "changes=false" >> $GITHUB_OUTPUT
fi

- name: Commit and push changes
if: steps.check_changes.outputs.changes == 'true'
run: |
git config --local user.email "github-actions[bot]@users.noreply.github.com"
git config --local user.name "github-actions[bot]"
git add tests/
git commit -m "chore: Auto-tune pytest slow markers"
git push

- name: Add reaction to comment
uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9 # v5.0.0
with:
token: ${{ secrets.GITHUB_TOKEN }}
repository: ${{ github.event.client_payload.github.payload.repository.full_name }}
comment-id: ${{ github.event.client_payload.github.payload.comment.id }}
reactions: rocket

- name: Comment on PR with results
uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9 # v5.0.0
with:
token: ${{ secrets.GITHUB_TOKEN }}
issue-number: ${{ github.event.client_payload.github.payload.issue.number }}
body: |
✅ Slow marker tuning complete!

${{ steps.check_changes.outputs.changes == 'true' && 'Changes have been committed and pushed to this PR.' || 'No changes were needed - all markers are already correctly set.' }}

- name: Comment on PR with failure
if: failure()
uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9 # v5.0.0
with:
token: ${{ secrets.GITHUB_TOKEN }}
issue-number: ${{ github.event.client_payload.github.payload.issue.number }}
body: |
❌ Slow marker tuning failed. Please check the [workflow logs](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}) for details.
Loading
Loading