From 9ed6a7c4e589cfb6469088354605de01ff0941c5 Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 17 Jul 2026 05:54:38 +0000 Subject: [PATCH 1/2] fix(ci): add least-privilege permissions to the openapi workflow job The `openapi` job in .github/workflows/gavel.yml had no `permissions` block and therefore inherited the broad default GITHUB_TOKEN scope. Add an explicit `permissions: contents: read` block, matching the pattern already used by the `test` and `lint` jobs. Resolves CodeQL code scanning alert #98 (Workflow does not contain permissions). Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_01RiL4boF4wcNwKdvSRinVEf --- .github/workflows/gavel.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/gavel.yml b/.github/workflows/gavel.yml index 92adb76e..21ed3fb4 100644 --- a/.github/workflows/gavel.yml +++ b/.github/workflows/gavel.yml @@ -82,6 +82,8 @@ jobs: openapi: name: OpenAPI Integration runs-on: ubuntu-latest + permissions: + contents: read steps: - name: Checkout code uses: actions/checkout@v4 From b25e62bd444952457afdc558cac67a4a241a2e9e Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 17 Jul 2026 06:45:33 +0000 Subject: [PATCH 2/2] fix(examples): bump examples/enitity clicky dep to v1.21.39 The v1.21.39 release pinned sub-modules to v1.21.39, but examples/enitity/go.mod was left requiring clicky v1.21.38. That stale pin left the module graph out of sync, so gavel's read-only test pre-build failed with "go: updates to go.mod needed; run go mod tidy", breaking CI on this PR. Run go mod tidy to align the pin with the rest of the release. Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_01RiL4boF4wcNwKdvSRinVEf --- examples/enitity/go.mod | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/examples/enitity/go.mod b/examples/enitity/go.mod index daa580c5..82f9bbe2 100644 --- a/examples/enitity/go.mod +++ b/examples/enitity/go.mod @@ -3,7 +3,7 @@ module github.com/flanksource/clicky/examples/enitity go 1.26.1 require ( - github.com/flanksource/clicky v1.21.38 + github.com/flanksource/clicky v1.21.39 github.com/flanksource/clicky/aichat v1.21.37-0.20260707073215-39f9301d5c01 github.com/spf13/cobra v1.10.2 )