stacklok / toolhive-studio / 24842432410 / 1

70%

main: 70%

push

github

fix(ci): grant security-fix job permissions in on-main workflow (#2094)

The top-level 'permissions: contents: read' in on-main.yml was capping the permissions requested by the reusable _security-fix-agent.yml workflow, causing the workflow file to be rejected as invalid on merges to main:

  The nested job 'remediate' is requesting
  'contents: write, issues: write, pull-requests: write, id-token: write',
  but is only allowed 'contents: read, issues: none, pull-requests: none, id-token: none'.

Grant the elevated permissions explicitly on the 'security-fix' job so the called workflow can run, while keeping the restrictive defaults for every other job.

3922 of 6421 branches covered (61.08%)

6096 of 9140 relevant lines covered (66.7%)

120.0 hits per line