Update Workflows to Version 1.0.1 by epiverse-trace-bot · Pull Request #58 · epiverse-trace/epimodelac

epiverse-trace-bot · 2026-01-20T01:01:38Z

🤖 This is an automated build

Update Workflows from sandpaper version 0.16.12 -> 1.0.1

Auto-generated by create-pull-request on 2026-05-12T02:06+00:00

github-actions · 2026-01-20T01:01:49Z

ℹ️ Modified Workflows

This pull request contains modified workflow files and no preview will be created.

Workflow files modified:

.github/workflows/README.md
.github/workflows/docker_apply_cache.yaml
.github/workflows/docker_build_deploy.yaml
.github/workflows/docker_pr_receive.yaml
.github/workflows/pr-close-signal.yaml
.github/workflows/pr-comment.yaml
.github/workflows/pr-preflight.yaml
.github/workflows/sandpaper-version.txt
.github/workflows/update-cache.yaml
.github/workflows/update-workflows.yaml
.github/workflows/workflows-version.txt

If this is not from a trusted source, please inspect the changes for any malicious content.

+    name: "Preflight: PR or Manual Trigger?"
+    runs-on: ubuntu-latest
+    outputs:
+      do-apply: ${{ steps.check.outputs.merged_or_manual }}
+    steps:
+      - name: "Should we run cache application?"
+        id: check
+        run: |
+          if [[ "${{ github.event_name }}" == "workflow_dispatch" ||
+                ("${{ github.ref }}" == "refs/heads/main" && "${{ github.event.action }}" == "closed" && "${{ github.event.pull_request.merged }}" == "true") ]]; then
+            echo "merged_or_manual=true" >> $GITHUB_OUTPUT
+          else
+            echo "This was not a manual trigger and no PR was merged. No action taken."
+            echo "merged_or_manual=false" >> $GITHUB_OUTPUT
+          fi
+        shell: bash
+
+  check-renv:


Add a workflow-level permissions block near the top of .github/workflows/docker_apply_cache.yaml (after on: and before concurrency: is a clean location) to enforce least privilege for all jobs by default.

Best fix here (without changing functionality): set default read-only permissions required by typical checkout/artifact usage:

contents: read

packages: read

Keep the existing job-level override in check-renv:

id-token: write

Because job-level permissions override workflow-level defaults, this preserves OIDC behavior for check-renv while ensuring every other job gets explicitly restricted token access.

+    name: "No renv cache used"
+    runs-on: ubuntu-latest
+    needs: check-renv
+    if: needs.check-renv.outputs.renv-needed != 'true'
+    steps:
+      - name: "No renv cache needed"
+        run: echo "No renv cache needed for this lesson"
+
+  renv-cache-available:


Add an explicit top-level permissions block in .github/workflows/docker_apply_cache.yaml so all jobs default to least privilege.
Use:

contents: read (safe minimal baseline for checkout/read access)

packages: read (recommended minimal read scope for package operations)

Then, keep job-specific elevated permissions only where required. The existing check-renv job already needs OIDC (id-token: write), but once a job-level permissions block exists, unspecified scopes become none. Since that job passes ${{ secrets.GITHUB_TOKEN }} to an action, add contents: read there too so token-based read operations continue to work.

Edits are confined to:

Insert workflow-level permissions after concurrency

Update jobs.check-renv.permissions to include contents: read alongside id-token: write

No imports/dependencies are needed.

+    name: "renv cache available"
+    runs-on: ubuntu-latest
+    needs: check-renv
+    if: needs.check-renv.outputs.renv-cache-available == 'true'
+    steps:
+      - name: "renv cache available"
+        run: echo "renv cache available for this lesson"
+
+  update-renv-cache:


Add an explicit root-level permissions block in .github/workflows/docker_apply_cache.yaml so all jobs without their own permissions are constrained by default.

Best single fix without changing functionality:

Insert at the workflow root (after concurrency and before jobs):

permissions:

contents: read

Why this is best:

It addresses the CodeQL finding for jobs like renv-cache-available.

It preserves existing behavior for jobs that already define their own permissions (like update-renv-cache), since job-level settings override workflow-level defaults.

It applies least privilege across the whole workflow with minimal change surface.

No imports, methods, or dependencies are needed (YAML workflow change only).

+    name: "Preflight: Schedule, Push, or PR?"
+    runs-on: ubuntu-latest
+    outputs:
+      do-build: ${{ steps.build-check.outputs.do-build }}
+      renv-needed: ${{ steps.build-check.outputs.renv-needed }}
+      renv-cache-hashsum: ${{ steps.build-check.outputs.renv-cache-hashsum }}
+      workbench-container-file-exists: ${{ steps.wb-vers.outputs.workbench-container-file-exists }}
+      wb-vers: ${{ steps.wb-vers.outputs.container-version }}
+      last-wb-vers: ${{ steps.wb-vers.outputs.last-container-version }}
+      workbench-update: ${{ steps.wb-vers.outputs.workbench-update }}
+    env:
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+    steps:
+      - name: "Should we run build and deploy?"
+        id: build-check
+        uses: carpentries/actions/build-preflight@main
+
+      - name: "Checkout Lesson"
+        if: steps.build-check.outputs.do-build == 'true'
+        uses: actions/checkout@v4
+
+      - name: "Get container version info"
+        id: wb-vers
+        if: steps.build-check.outputs.do-build == 'true'
+        uses: carpentries/actions/container-version@main
+        with:
+          WORKBENCH_TAG: ${{ vars.WORKBENCH_TAG }}
+          renv-needed: ${{ steps.build-check.outputs.renv-needed }}
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+  full-build:


Add an explicit permissions block to the preflight job with least privilege, specifically contents: read. This satisfies CodeQL’s requirement and aligns with least-privilege practice. Since other jobs already have their own explicit permissions, only preflight needs to be changed. No imports, methods, or dependency changes are needed.

Edit only .github/workflows/docker_build_deploy.yaml, in the jobs.preflight section, immediately after runs-on.

@@ -33,48 +52,42 @@ jobs:
            echo "ok=false" >> $GITHUB_OUTPUT
            echo "Not Running Today"
          fi
+        shell: bash

-  check_renv:
-    name: "Check if We Need {renv}"
-    runs-on: ubuntu-22.04
+  check-renv:
+    name: "Check If We Need {renv}"
+    runs-on: ubuntu-latest
    needs: preflight
-    if: ${{ needs.preflight.outputs.ok == 'true'}}
+    if: ${{ needs.preflight.outputs.ok == 'true' }}


Add an explicit root-level permissions block in .github/workflows/update-cache.yaml so all jobs have constrained defaults, while keeping the existing job-level permissions for update_cache unchanged (job-level values override root where needed).

Best single fix without changing functionality:

Insert at workflow root (after on: block, before env: is ideal):

permissions:

contents: read

This gives preflight and check-renv least-privilege baseline access and preserves existing behavior for update_cache since it already declares broader write scopes.

No imports/dependencies/methods are needed (YAML config only).

+    name: "Record Caching Status"
+    runs-on: ubuntu-latest
+    needs: [check-renv, update-renv-cache]
+    if: always()
+    env:
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+    steps:
+      - name: "Record cache result"
+
+        run: |
+          echo "${{ needs.update-renv-cache.result == 'success' || needs.check-renv.outputs.renv-cache-available == 'true' || 'false' }}" > ${{ github.workspace }}/apply-cache-result
+        shell: bash
+
+      - name: "Upload cache result"
+        uses: actions/upload-artifact@v4
+        with:
+          name: apply-cache-result
+          path: ${{ github.workspace }}/apply-cache-result


Add an explicit permissions block at the workflow root so all jobs inherit least-privilege defaults. For this workflow, a safe minimal baseline is:

contents: read (common for checkout/read operations)

actions: read (safe baseline for action metadata access)

Additionally, because the workflow configures AWS via OIDC (aws-actions/configure-aws-credentials@v6 with role assumption), it needs:

id-token: write (required to request OIDC token)

Apply this in .github/workflows/docker_apply_cache.yaml directly under description and before on:. This preserves existing behavior while explicitly constraining token permissions.

epiverse-trace-bot added the type: template and tools label Jan 20, 2026

github-advanced-security AI found potential problems Jan 20, 2026

View reviewed changes

epiverse-trace-bot changed the title ~~Update Workflows to Version 0.18.3~~ Update Workflows to Version 0.18.4 Jan 27, 2026

epiverse-trace-bot force-pushed the update/workflows branch from 2c7beb2 to 3e904fb Compare January 27, 2026 01:06

epiverse-trace-bot changed the title ~~Update Workflows to Version 0.18.4~~ Update Workflows to Version 0.18.5 Feb 3, 2026

epiverse-trace-bot force-pushed the update/workflows branch from 3e904fb to 44c88e6 Compare February 3, 2026 01:16

github-advanced-security AI found potential problems Feb 3, 2026

View reviewed changes

epiverse-trace-bot force-pushed the update/workflows branch from 44c88e6 to eab816c Compare February 10, 2026 01:26

epiverse-trace-bot force-pushed the update/workflows branch from eab816c to 87c38f3 Compare March 3, 2026 01:17

epiverse-trace-bot changed the title ~~Update Workflows to Version 0.18.5~~ Update Workflows to Version 1.0.0 Mar 3, 2026

[actions] update sandpaper workflow to version 1.0.1

983ef6c

epiverse-trace-bot changed the title ~~Update Workflows to Version 1.0.0~~ Update Workflows to Version 1.0.1 Apr 21, 2026

epiverse-trace-bot force-pushed the update/workflows branch from 87c38f3 to 983ef6c Compare April 21, 2026 01:45

@@ -25,6 +25,9 @@
                     default: false
                     type: boolean
+            permissions:
+              contents: read
             env:
               LOCKFILE_CACHE_GEN: ${{ vars.LOCKFILE_CACHE_GEN || github.event.inputs.generate-cache || 'false' }}
               FORCE_RENV_INIT: ${{ vars.FORCE_RENV_INIT || github.event.inputs.force-renv-init || 'false' }}

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update Workflows to Version 1.0.1#58

Update Workflows to Version 1.0.1#58
epiverse-trace-bot wants to merge 1 commit into
mainfrom
update/workflows

epiverse-trace-bot commented Jan 20, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jan 20, 2026 •

edited

Loading

Uh oh!

Check warning

Copilot Autofix

Check warning

Copilot Autofix

Check warning

Copilot Autofix

Uh oh!

Check warning

Copilot Autofix

Check warning

Copilot Autofix

Check warning

Copilot Autofix

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

@@ -13,6 +13,10 @@
                 branches:
                   - main
+            permissions:
+              contents: read
+              packages: read
             # queue cache runs
             concurrency:
               group: docker-apply-cache

@@ -1,5 +1,9 @@
             name: "03 Maintain: Apply Package Cache"
             description: "Generate the package cache for the lesson after a pull request has been merged or via manual trigger, and cache in S3 or GitHub"
+            permissions:
+              contents: read
+              actions: read
+              id-token: write
             on:
               workflow_dispatch:
                 inputs:

Conversation

epiverse-trace-bot commented Jan 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jan 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

ℹ️ Modified Workflows

Uh oh!

Check warning

Copilot Autofix

Check warning

Copilot Autofix

Check warning

Copilot Autofix

Uh oh!

Check warning

Copilot Autofix

Check warning

Copilot Autofix

Check warning

Copilot Autofix

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

epiverse-trace-bot commented Jan 20, 2026 •

edited

Loading

github-actions Bot commented Jan 20, 2026 •

edited

Loading