Update Workflows to Version 1.0.1 by epiverse-trace-bot · Pull Request #63 · epiverse-trace/research-compendium

epiverse-trace-bot · 2026-01-20T00:53:27Z

🤖 This is an automated build

Update Workflows from sandpaper version 0.16.12 -> 1.0.1

Auto-generated by create-pull-request on 2026-05-19T02:04+00:00

github-actions · 2026-01-20T00:53:38Z

ℹ️ Modified Workflows

This pull request contains modified workflow files and no preview will be created.

Workflow files modified:

.github/workflows/README.md
.github/workflows/docker_apply_cache.yaml
.github/workflows/docker_build_deploy.yaml
.github/workflows/docker_pr_receive.yaml
.github/workflows/pr-close-signal.yaml
.github/workflows/pr-comment.yaml
.github/workflows/pr-preflight.yaml
.github/workflows/sandpaper-version.txt
.github/workflows/update-cache.yaml
.github/workflows/update-workflows.yaml
.github/workflows/workflows-version.txt

If this is not from a trusted source, please inspect the changes for any malicious content.

+    name: "Preflight: PR or Manual Trigger?"
+    runs-on: ubuntu-latest
+    outputs:
+      do-apply: ${{ steps.check.outputs.merged_or_manual }}
+    steps:
+      - name: "Should we run cache application?"
+        id: check
+        run: |
+          if [[ "${{ github.event_name }}" == "workflow_dispatch" ||
+                ("${{ github.ref }}" == "refs/heads/main" && "${{ github.event.action }}" == "closed" && "${{ github.event.pull_request.merged }}" == "true") ]]; then
+            echo "merged_or_manual=true" >> $GITHUB_OUTPUT
+          else
+            echo "This was not a manual trigger and no PR was merged. No action taken."
+            echo "merged_or_manual=false" >> $GITHUB_OUTPUT
+          fi
+        shell: bash
+
+  check-renv:


The best fix is to add a workflow-level permissions block near the top of .github/workflows/docker_apply_cache.yaml, so all jobs get a restricted default token scope. Keep existing job-level overrides (like check-renv with id-token: write) unchanged, because job-level permissions can extend/override as needed for OIDC.

For this workflow, a safe minimal baseline is:

contents: read (common read access for repository content)

optionally actions: read if needed by marketplace actions resolution (often not required explicitly, but acceptable)

Given the static analysis recommendation and least-privilege principle, adding permissions: { contents: read } at workflow root is the single best low-risk change that does not alter intended functionality.

+    name: "No renv cache used"
+    runs-on: ubuntu-latest
+    needs: check-renv
+    if: needs.check-renv.outputs.renv-needed != 'true'
+    steps:
+      - name: "No renv cache needed"
+        run: echo "No renv cache needed for this lesson"
+
+  renv-cache-available:


Add an explicit root-level permissions block for the workflow so all jobs (including no-renv-cache-used) are constrained by default. Use least privilege baseline:

contents: read (common minimal read access),

packages: read (recommended minimal for package-related workflows; harmless if unused).

Keep the existing check-renv job-level permissions block (id-token: write) as-is, since it appears to require OIDC for AWS role assumption. Job-level permissions will override/augment defaults for that job as needed.

Where to change: .github/workflows/docker_apply_cache.yaml, near the top-level keys (after concurrency is a clean location), before jobs:.

No imports/dependencies/methods are needed (YAML config only).

+    name: "renv cache available"
+    runs-on: ubuntu-latest
+    needs: check-renv
+    if: needs.check-renv.outputs.renv-cache-available == 'true'
+    steps:
+      - name: "renv cache available"
+        run: echo "renv cache available for this lesson"
+
+  update-renv-cache:


Add an explicit root-level permissions block in .github/workflows/docker_apply_cache.yaml so all jobs without their own permissions inherit least-privilege defaults. The safest minimal baseline here is:

contents: read (common for checkout/read repo metadata)

packages: read (often needed for package/container pulls)

Keep existing job-specific permissions (like the one already under update-renv-cache) unchanged; job-level permissions will continue to override root-level defaults where needed.
Edit near the top of the workflow (after concurrency is a clean location) and add the block before jobs:.

+    name: "Preflight: Schedule, Push, or PR?"
+    runs-on: ubuntu-latest
+    outputs:
+      do-build: ${{ steps.build-check.outputs.do-build }}
+      renv-needed: ${{ steps.build-check.outputs.renv-needed }}
+      renv-cache-hashsum: ${{ steps.build-check.outputs.renv-cache-hashsum }}
+      workbench-container-file-exists: ${{ steps.wb-vers.outputs.workbench-container-file-exists }}
+      wb-vers: ${{ steps.wb-vers.outputs.container-version }}
+      last-wb-vers: ${{ steps.wb-vers.outputs.last-container-version }}
+      workbench-update: ${{ steps.wb-vers.outputs.workbench-update }}
+    env:
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+    steps:
+      - name: "Should we run build and deploy?"
+        id: build-check
+        uses: carpentries/actions/build-preflight@main
+
+      - name: "Checkout Lesson"
+        if: steps.build-check.outputs.do-build == 'true'
+        uses: actions/checkout@v4
+
+      - name: "Get container version info"
+        id: wb-vers
+        if: steps.build-check.outputs.do-build == 'true'
+        uses: carpentries/actions/container-version@main
+        with:
+          WORKBENCH_TAG: ${{ vars.WORKBENCH_TAG }}
+          renv-needed: ${{ steps.build-check.outputs.renv-needed }}
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+  full-build:


Add an explicit permissions block to the preflight job in .github/workflows/docker_build_deploy.yaml so the token is minimally scoped for that job.
Best single fix (without changing functionality): set contents: read under jobs.preflight, since the job checks out code and reads metadata, and there is no shown write operation in that job. Keep existing permissions for other jobs unchanged.

Edit region: in .github/workflows/docker_build_deploy.yaml, directly under:

preflight:

name: "Preflight: Schedule, Push, or PR?"

runs-on: ubuntu-latest

insert:

permissions: contents: read

No imports/dependencies/methods are needed.

@@ -33,48 +52,42 @@ jobs:
            echo "ok=false" >> $GITHUB_OUTPUT
            echo "Not Running Today"
          fi
+        shell: bash

-  check_renv:
-    name: "Check if We Need {renv}"
-    runs-on: ubuntu-22.04
+  check-renv:
+    name: "Check If We Need {renv}"
+    runs-on: ubuntu-latest
    needs: preflight
-    if: ${{ needs.preflight.outputs.ok == 'true'}}
+    if: ${{ needs.preflight.outputs.ok == 'true' }}


Add a workflow-level permissions block near the top of .github/workflows/update-cache.yaml (after on: is the safest placement here), setting minimal default permissions for jobs that do not declare their own permissions.

Best fix for this file:

Add:

permissions:

contents: read

Do not remove or alter update_cache job permissions; its job-level write scopes are likely required for PR creation and should override the workflow default.

No imports, methods, or dependencies are needed (YAML config-only change).

+    name: "Record Caching Status"
+    runs-on: ubuntu-latest
+    needs: [check-renv, update-renv-cache]
+    if: always()
+    env:
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+    steps:
+      - name: "Record cache result"
+
+        run: |
+          echo "${{ needs.update-renv-cache.result == 'success' || needs.check-renv.outputs.renv-cache-available == 'true' || 'false' }}" > ${{ github.workspace }}/apply-cache-result
+        shell: bash
+
+      - name: "Upload cache result"
+        uses: actions/upload-artifact@v4
+        with:
+          name: apply-cache-result
+          path: ${{ github.workspace }}/apply-cache-result


Add an explicit permissions block to the workflow so all jobs (including record-cache-result) inherit least-privilege defaults.
Best single fix with minimal functional change: add a root-level permissions section after concurrency and before jobs.

Given this workflow uploads artifacts and uses OIDC for AWS credentials, include:

contents: read (safe baseline for checkout/read operations),

actions: read (safe for reading action metadata),

id-token: write (required for OIDC token minting used by aws-actions/configure-aws-credentials).

No imports/dependencies/methods are needed (YAML config only).
File to edit: .github/workflows/docker_apply_cache.yaml in the top-level section around lines 16–21.

epiverse-trace-bot added the type: template and tools label Jan 20, 2026

github-advanced-security AI found potential problems Jan 20, 2026

View reviewed changes

epiverse-trace-bot force-pushed the update/workflows branch from 7f617e7 to 3698b7c Compare January 27, 2026 00:57

epiverse-trace-bot changed the title ~~Update Workflows to Version 0.18.3~~ Update Workflows to Version 0.18.4 Jan 27, 2026

epiverse-trace-bot force-pushed the update/workflows branch from 3698b7c to 342b5ea Compare February 3, 2026 01:06

epiverse-trace-bot changed the title ~~Update Workflows to Version 0.18.4~~ Update Workflows to Version 0.18.5 Feb 3, 2026

github-advanced-security AI found potential problems Feb 3, 2026

View reviewed changes

epiverse-trace-bot force-pushed the update/workflows branch from 342b5ea to db27d3d Compare February 10, 2026 01:17

epiverse-trace-bot force-pushed the update/workflows branch from db27d3d to 8f9e53d Compare March 3, 2026 01:07

epiverse-trace-bot changed the title ~~Update Workflows to Version 0.18.5~~ Update Workflows to Version 1.0.0 Mar 3, 2026

[actions] update sandpaper workflow to version 1.0.1

2d9ff63

epiverse-trace-bot changed the title ~~Update Workflows to Version 1.0.0~~ Update Workflows to Version 1.0.1 Apr 21, 2026

epiverse-trace-bot force-pushed the update/workflows branch from 8f9e53d to 2d9ff63 Compare April 21, 2026 01:21

@@ -1,5 +1,7 @@
             name: "03 Maintain: Apply Package Cache"
             description: "Generate the package cache for the lesson after a pull request has been merged or via manual trigger, and cache in S3 or GitHub"
+            permissions:
+              contents: read
             on:
               workflow_dispatch:
                 inputs:

@@ -25,6 +25,9 @@
                     default: false
                     type: boolean
+            permissions:
+              contents: read
             env:
               LOCKFILE_CACHE_GEN: ${{ vars.LOCKFILE_CACHE_GEN || github.event.inputs.generate-cache || 'false' }}
               FORCE_RENV_INIT: ${{ vars.FORCE_RENV_INIT || github.event.inputs.force-renv-init || 'false' }}

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update Workflows to Version 1.0.1#63

Update Workflows to Version 1.0.1#63
epiverse-trace-bot wants to merge 1 commit into
mainfrom
update/workflows

epiverse-trace-bot commented Jan 20, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jan 20, 2026 •

edited

Loading

Uh oh!

Check warning

Copilot Autofix

Check warning

Copilot Autofix

Check warning

Copilot Autofix

Uh oh!

Check warning

Copilot Autofix

Check warning

Copilot Autofix

Check warning

Copilot Autofix

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

@@ -18,6 +18,10 @@
               group: docker-apply-cache
               cancel-in-progress: false
+            permissions:
+              contents: read
+              packages: read
             jobs:
               preflight:
                 name: "Preflight: PR or Manual Trigger?"

Conversation

epiverse-trace-bot commented Jan 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jan 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

ℹ️ Modified Workflows

Uh oh!

Check warning

Copilot Autofix

Check warning

Copilot Autofix

Check warning

Copilot Autofix

Uh oh!

Check warning

Copilot Autofix

Check warning

Copilot Autofix

Check warning

Copilot Autofix

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

epiverse-trace-bot commented Jan 20, 2026 •

edited

Loading

github-actions Bot commented Jan 20, 2026 •

edited

Loading