[lewisjared]

Gives the ci-pass job an empty permissions block, because it only reads the results of other jobs and needs no token access. This was meant for #160 but landed after it merged. CodeQL flagged the same job in climate-ref.

Summary by CodeRabbit

• Chores
  • The CI pass job now runs without GitHub Actions token permissions. The workflow also has read-only access to repository contents and pull requests. These changes affect the project’s build and validation process only; they do not change app functionality or the end-user experience. No other user-visible changes are included in this release.

[coderabbitai]

Walkthrough

The workflow now grants read permissions for repository contents and pull requests. The ci-pass job sets its permissions to an empty set. A changelog entry records the job-level change.

Changes: ci-pass token permissions

Layer / File(s)	Summary
Set ci-pass permissions .github/workflows/ci.yml, changelog/164.trivial.md	The workflow grants read permissions for repository contents and pull requests. The ci-pass job overrides these permissions with an empty set. The changelog records this change.

Possibly related PRs

• Climate-REF/ref-app#160: This PR introduced the ci-pass job that this change updates.

Priority: Low

Change: Other

Merge Risk: Low · up to 88ae3

Remove the unnecessary pull-request permission to keep CI tokens least-privileged.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: removing token permissions from the ci-pass job.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

---

Review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 586f0b91-40e4-42a7-8045-0c669b613d0c

Commits

Reviewing files that changed from the base of the PR and between 9c480e5 and 8fc1e5f.

Files selected for processing: 2

• .github/workflows/ci.yml
• changelog/164.trivial.md

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

[coderabbitai]

Actionable comments posted: 1

---

Review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: e33e531c-6d68-419d-b0eb-653c896f0856

Commits

Reviewing files that changed from the base of the PR and between 8fc1e5f and 88ae369.

Files selected for processing: 1

• .github/workflows/ci.yml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

[coderabbitai]

Minor · Security & Privacy · Quick win

Remove pull-requests: read from the workflow permissions.

No job in this workflow needs pull request access. The four checkout jobs need only contents: read. The tj-actions/changed-files step in check-changelog runs after actions/checkout, so it uses the local Git path. It calls the pull request REST API only when use_rest_api is true, and this workflow does not set that input. The other jobs make no GitHub API calls.

The workflow-level grant gives every step in the four checkout jobs a token that can read pull request data. These jobs run checked-out code and dependency install scripts, and they do not use that access. ci-pass already sets permissions: {}, so this change does not affect it.

Suggested fix

--- "a/.github/workflows/ci.yml"
+++ "b/.github/workflows/ci.yml"
@@ -6,9 +6,8 @@
     branches: [main]
     tags: ['v*']
 
 permissions:
   contents: read
-  pull-requests: read
 
 jobs:
   check-changelog:

Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	permissions:
	contents: read
	pull-requests: read
	permissions:
	contents: read