🔄 Synced file(s) with ottrproject/OTTR_Template #39
Conversation
|
Please carefully review these changes and decide which are useful for your course.
You may want to unenroll your repository from the sync GitHub actions by filing a PR on |
|
|
|
|
release-renderAction
release-renderAction
…/style_config_default.css' release-renderAction
….yml' release-renderAction
jhudsl-robot
changed the title
jhudsl-robot
force-pushed
the
repo-sync/OTTR_Template/default
branch
from
f1ea2ae to
f763856
Compare
OTTR Check ResultsSummary
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| name: Load user automation choices | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Checkout | ||
| uses: actions/checkout@v3 | ||
| with: | ||
| fetch-depth: 0 | ||
|
|
||
| # Use the yaml-env-action action. | ||
| - name: Load environment from YAML | ||
| uses: doughepi/[email protected] | ||
| with: | ||
| files: config_automation.yml # Pass a space-separated list of configuration files. Rightmost files take precedence. | ||
| outputs: | ||
| toggle_url_check_periodically: "${{ env.URL_CHECK_PERIODICALLY }}" | ||
|
|
||
| url-check: |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI about 22 hours ago
To fix the issue, we need to explicitly define the permissions for the workflow. The permissions block should be added at the root level of the workflow file to apply to all jobs unless overridden. Based on the workflow's operations, the following permissions are required:
contents: writefor committing and pushing changes to the repository.actions: readfor interacting with GitHub Actions artifacts.- Other permissions are not required based on the workflow's functionality.
The permissions block will be added at the top of the workflow file, ensuring that the GITHUB_TOKEN has only the necessary permissions.
| @@ -2,2 +2,5 @@ | ||
|
|
||
| permissions: | ||
| contents: write | ||
| actions: read | ||
|
|
| name: Check URLs | ||
| needs: set-up | ||
| if: ${{needs.set-up.outputs.toggle_url_check_periodically == 'true'}} | ||
| runs-on: ubuntu-latest | ||
|
|
||
| steps: | ||
| - name: Checkout | ||
| uses: actions/checkout@v3 | ||
| with: | ||
| fetch-depth: 0 | ||
|
|
||
| # Delete the branch if this has been run before | ||
| - name: Delete branch locally and remotely | ||
| run: git push origin --delete preview-spell-error || echo "No branch to delete" | ||
|
|
||
| # Make the branch fresh | ||
| - name: Make the branch fresh | ||
| run: | | ||
| git config --global --add safe.directory $GITHUB_WORKSPACE | ||
| git config --global user.name 'github-actions[bot]' | ||
| git config --global user.email 'github-actions[bot]@users.noreply.github.com' | ||
|
|
||
| echo branch doesnt exist | ||
| git checkout -b preview-spell-error || echo branch exists | ||
| git push --set-upstream origin preview-spell-error || echo echo branch exists remotely | ||
| shell: bash | ||
|
|
||
| - name: Run the check | ||
| uses: ottrproject/ottr-reports@main | ||
| id: check_results | ||
| continue-on-error: true | ||
| with: | ||
| check_spelling: false | ||
| spelling_error_min: 1 | ||
| check_urls: true | ||
| url_error_min: 1 | ||
| check_quiz_form: false | ||
| quiz_error_min: 1 | ||
| sort_dictionary: false | ||
|
|
||
| - name: Declare file path and time | ||
| id: check-report | ||
| run: | | ||
| error_num=$(cat check_reports/url_checks.tsv | wc -l) | ||
| error_num="$((error_num-1))" | ||
| echo "error_num=$error_num" >> $GITHUB_OUTPUT | ||
| echo "error_url=https://github.com/${GITHUB_REPOSITORY}/blob/preview-spell-error/check_reports/url_checks.tsv" >> $GITHUB_OUTPUT | ||
| shell: bash | ||
|
|
||
| - name: Stop if failure | ||
| if: steps.check_results.outcome == 'failure' | ||
| run: exit 1 | ||
|
|
||
| - name: Print out error variables | ||
| run: | | ||
| echo ${{ steps.check-report.outputs.error_url }} | ||
| echo ${{ steps.check-report.outputs.error_num }} | ||
|
|
||
| # Commit file | ||
| - name: Commit tocless bookdown files | ||
| if: ${{ steps.check-report.outputs.error_num >= 1 }} | ||
| env: | ||
| GH_PAT: ${{ secrets.GH_PAT }} | ||
| run: | | ||
| git add --force check_reports/url_checks.tsv | ||
| git commit -m 'Add spell check file' || echo "No changes to commit" | ||
| git push --set-upstream origin preview-spell-error || echo echo branch exists remotely | ||
|
|
||
| - name: Find issues | ||
| id: find-issue | ||
| env: | ||
| GH_PAT: ${{ secrets.GH_PAT }} | ||
| run: | | ||
| echo "$GITHUB_REPOSITORY" | ||
| curl -o find_issue.R https://raw.githubusercontent.com/ottrproject/ottr-reports/main/scripts/find_issue.R | ||
| issue_exists=$(Rscript --vanilla find_issue.R --repo $GITHUB_REPOSITORY --git_pat $GH_PAT) | ||
| echo URL issue exists: $issue_exists | ||
| echo "issue_existence=$issue_exists" >> $GITHUB_OUTPUT | ||
|
|
||
| - name: If too many URL errors, then make an issue | ||
| if: ${{ steps.check-report.outputs.error_num >= 1 && steps.find-issue.outputs.issue_existence == 0}} | ||
| uses: JasonEtco/create-an-issue@v2 | ||
| with: | ||
| filename: .github/ISSUE_TEMPLATE/url-error.md | ||
| env: | ||
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
| FILE_URL: ${{ steps.check-report.outputs.error_url }} | ||
| ERROR_NUM: ${{ steps.check-report.outputs.error_num }} | ||
|
|
||
| - name: If no URL errors than delete the branch we made | ||
| if: ${{ steps.check-report.outputs.error_num < 1 }} | ||
| run: | | ||
| git config --system --add safe.directory "$GITHUB_WORKSPACE" | ||
| git push origin --delete preview-spell-error || echo "No branch to delete" |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI about 22 hours ago
To fix the issue, we need to add a permissions block to the url-check job to explicitly define the required permissions for the GITHUB_TOKEN. Based on the actions performed in the job, the following permissions are necessary:
contents: writefor pushing branches and committing files.issues: writefor creating issues.
The permissions block should be added at the job level to limit the scope of these permissions to the url-check job only.
| @@ -31,2 +31,5 @@ | ||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| contents: write | ||
| issues: write | ||
|
|
|
|
||
| # Run bookdown rendering | ||
| - name: Run bookdown render | ||
| id: bookdown | ||
| if: ${{needs.yaml-check.outputs.toggle_website == 'rmd' }} | ||
| run: Rscript -e "bookdown::render_book('index.Rmd', output_format = 'all')" | ||
|
|
||
| # Run quarto rendering | ||
| - name: Render quarto version | ||
| id: quarto | ||
| if: ${{needs.yaml-check.outputs.toggle_website == 'quarto' }} | ||
| run: Rscript -e "quarto::quarto_render('.')" | ||
|
|
||
| # This checks on the steps before it and makes sure that they completed. | ||
| # If the renders didn't complete we don't want to commit the file changes | ||
| - name: Check on Rmd render steps | ||
| if: ${{needs.yaml-check.outputs.toggle_website == 'rmd' }} | ||
| run: | | ||
| echo Bookdown status ${{steps.bookdown.outcome}} | ||
| if [${{steps.bookdown.outcome}} != 'success']; then | ||
| exit 1 | ||
| fi | ||
|
|
||
| - name: Check on quarto render steps | ||
| if: ${{needs.yaml-check.outputs.toggle_website == 'quarto' }} | ||
| run: | | ||
| echo Quarto status ${{steps.quarto.outcome}} | ||
| if [${{steps.quarto.outcome}} != 'success']; then | ||
| exit 1 | ||
| fi | ||
|
|
||
| - name: Website preview for download | ||
| run: zip website-preview.zip docs/* -r | ||
|
|
||
| # Commit the rendered bookdown files | ||
| - name: Commit rendered bookdown files to preview branch | ||
| id: commit | ||
| run: | | ||
| branch_name='preview-${{ github.event.pull_request.number }}' | ||
| git diff origin/main -- docs >/dev/null && changes=true || changes=false | ||
| echo "changes=$changes" >> $GITHUB_OUTPUT | ||
| git add . --force | ||
| git commit -m 'Render preview' || echo "No changes to commit" | ||
| git pull --rebase --set-upstream origin $branch_name --allow-unrelated-histories --strategy-option=ours | ||
| git push --force || echo "No changes to commit" | ||
| shell: bash | ||
|
|
||
| - name: Find Comment | ||
| uses: peter-evans/find-comment@v2 | ||
| id: fc | ||
| - name: Readability report | ||
| uses: Rebilly/lexi@v2 | ||
| with: | ||
| issue-number: ${{ github.event.pull_request.number }} | ||
| comment-author: 'github-actions[bot]' | ||
| body-includes: latest commit | ||
| github-token: ${{ secrets.GH_PAT }} | ||
| glob: '**/*.md' | ||
|
|
||
| - name: Build components of the comment | ||
| id: build-components | ||
| run: | | ||
| course_name=$(head -n 1 _bookdown.yml | cut -d'"' -f 2| tr " " "-") | ||
| bookdown_link=$(echo "https://htmlpreview.github.io/?https://raw.githubusercontent.com/$GITHUB_REPOSITORY/preview-${{ github.event.pull_request.number }}/docs/index.html") | ||
| docx_link=$(echo "https://github.com/$GITHUB_REPOSITORY/raw/preview-${{ github.event.pull_request.number }}/docs/$course_name.docx") | ||
| zip_link=$(echo "https://github.com/$GITHUB_REPOSITORY/raw/preview-${{ github.event.pull_request.number }}/website-preview.zip") | ||
| echo "zip_link=$zip_link" >> $GITHUB_OUTPUT | ||
| echo "bookdown_link=$bookdown_link" >> $GITHUB_OUTPUT | ||
| echo "docx_link=$docx_link" >> $GITHUB_OUTPUT | ||
| echo "time=$(date +'%Y-%m-%d')" >> $GITHUB_OUTPUT | ||
| echo "commit_id=$GITHUB_SHA" >> $GITHUB_OUTPUT | ||
| echo ${{steps.commit.outputs.changes}} | ||
|
|
||
| - name: Create or update comment | ||
| if: steps.commit.outputs.changes == 'true' | ||
| uses: peter-evans/create-or-update-comment@v2 | ||
| with: | ||
| comment-id: ${{ steps.fc.outputs.comment-id }} | ||
| issue-number: ${{ github.event.pull_request.number }} | ||
| body: | | ||
| Re-rendered previews from the latest commit: | ||
| - :eyes: Quick [preview of course website here](${{ steps.build-components.outputs.bookdown_link }}) \* | ||
| - :microscope: Comprehensive [download of the course website here](${{ steps.build-components.outputs.zip_link }}) | ||
| - Download the [.docx file](${{ steps.build-components.outputs.docx_link }}) | ||
|
|
||
| \* note not all html features will be properly displayed in the "quick preview" but it will give you a rough idea. | ||
|
|
||
| _Updated at ${{ steps.build-components.outputs.time }} with changes from the latest commit ${{ steps.build-components.outputs.commit_id }}_ | ||
| edit-mode: replace | ||
|
|
||
| - name: Comment if no changes | ||
| if: steps.commit.outputs.changes == 'false' | ||
| uses: peter-evans/create-or-update-comment@v2 | ||
| with: | ||
| comment-id: ${{ steps.fc.outputs.comment-id }} | ||
| issue-number: ${{ github.event.pull_request.number }} | ||
| body: | | ||
| The latest commit did not produce rendering changes. | ||
| ############################# Render Preview ################################### | ||
| render-preview: |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI about 22 hours ago
To fix the issue, add a permissions block to the readability-report job. Based on the job's functionality, it likely only needs contents: read permissions to access the repository's files. This change ensures the job adheres to the principle of least privilege and prevents unintended actions using the GITHUB_TOKEN.
The permissions block should be added directly under the readability-report job definition (line 115).
| @@ -118,2 +118,4 @@ | ||
| if: ${{needs.yaml-check.outputs.toggle_readability == 'true'}} | ||
| permissions: | ||
| contents: read | ||
|
|
Synced local file(s) with ottrproject/OTTR_Template.
Changed files
.github/workflows/with remote directory.github/workflows/assets/style.csswith remoteassets/style.cssassets/style_config_default.cssfrom remoteassets/style_config_default.cssconfig_automation.ymlwith remoteconfig_automation.ymlThis PR was created automatically by the repo-file-sync-action workflow run #15498355326