codebase-memory-mcp

mirror of https://github.com/DeusData/codebase-memory-mcp.git synced 2026-11-04 08:13:37 +08:00

Files

T

Martin Vogel 09c0e88a64 fix(ci): grant the security permissions in dry-run.yml, and derive the caller list

#2189 gave codeql-gate the security-events:read it needs to see code-scanning
alerts, and granted it at the two callers I knew about: pr.yml and release.yml.
There is a third. dry-run.yml calls the same reusable workflow and was left
granting only the workflow default, so every dispatch of it now fails at
startup -- before a single job runs, with no job output to explain why.
Observed immediately: run 34725401182 on 7d74337e, startup_failure.

The contract test did not catch it because it iterated a hardcoded
("pr.yml", "release.yml"). A test that checks only the callers you remembered
cannot catch the one you forgot, and it reports green while doing so -- the
same shape of false assurance as the 403-to-"0 alerts" bug this whole contract
exists to prevent.

So the list is now derived: every workflow containing
`uses: ./.github/workflows/_security.yml` must grant security-events:read and
actions:read, with a floor of three callers so a silent deletion is noticed
too. Reverting only dry-run.yml's grant now fails the test by name.

Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>

2026-09-13 01:27:43 +02:00

_build.yml

build(deps): bump actions/attest-build-provenance from 4.1.1 to 4.2.2

2026-08-22 05:55:41 +00:00

_lint.yml

ci: repin the apt.llvm.org ASan + analyzer lanes to clang-21

2026-09-09 21:05:29 +02:00

_security.yml

fix(ci): make the code-scanning gate able to see alerts, and fail closed

2026-09-12 20:07:33 +02:00

_smoke.yml

fix(ci): finish the single-composition sweep in the smoke workflow