From e1d31954217900ac1de3fd5c9ac352f04caf3a7f Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 12 Oct 2026 09:22:08 +0000 Subject: [PATCH 1/2] Give pull request runs of check-abap2ui5 a read-only token The workflow granted contents: write to the whole run so that its last step could push the badges to the badges branch on main - which also gave every pull request run from a branch of this repository a write token while it ran the pull request's own code (npm ci, the linter). The token is now read-only by default; the gate job hands the badge files over as an artifact, and a separate publish-badges job, the only one with contents: write, pushes them exactly as before. It runs only on main (push, schedule, manual run), never for a pull request, and only after a green gate. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01Te3BRpRpxNhZAYnrQL6Gdt --- .github/workflows/check-abap2ui5.yaml | 61 +++++++++++++++++++++------ 1 file changed, 49 insertions(+), 12 deletions(-) diff --git a/.github/workflows/check-abap2ui5.yaml b/.github/workflows/check-abap2ui5.yaml index 0d919cd..477dcb8 100644 --- a/.github/workflows/check-abap2ui5.yaml +++ b/.github/workflows/check-abap2ui5.yaml @@ -22,7 +22,7 @@ on: workflow_dispatch: permissions: - contents: write + contents: read concurrency: group: check-abap2ui5-${{ github.ref }} @@ -32,6 +32,8 @@ jobs: check-abap2ui5: runs-on: ubuntu-latest timeout-minutes: 15 + outputs: + badges: ${{ steps.badges.outputs.found }} steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 @@ -52,18 +54,53 @@ jobs: run: npx abap2ui5lint --no-render --advisory --no-progress --no-badge --format markdown >> "$GITHUB_STEP_SUMMARY" # The gate above rewrote .github/badges/ (abap2ui5lint.jsonc "badge"), and - # this step publishes those two files to the `badges` branch - an - # orphan branch that holds nothing else and is what the README badges - # read. Only on main: main is protected and github-actions[bot] cannot - # bypass that, and the old way round - committing the badges onto the - # pull request branch - started a second set of runs on that commit which - # waited for a maintainer's approval and left the pull request blocked. - # A pull request run publishes nothing; the run on main after the merge - # does. Only after a green gate, as before. A failed push (a ruleset on - # the branch) is a warning: the README then keeps showing the previous - # state rather than a wrong one. - - name: Publish the badges + # the publish-badges job below pushes those two files to the `badges` + # branch - an orphan branch that holds nothing else and is what the README + # badges read. This job only hands them over: it runs pull request code and + # so keeps the read-only token. The push lives in a job of its own, the only + # one with contents: write, and that job never runs for a pull request. + - name: Check for badge files + id: badges if: success() && github.event_name != 'pull_request' && github.ref == 'refs/heads/main' + run: | + if ls .github/badges/*.json >/dev/null 2>&1; then + echo "found=true" >> "$GITHUB_OUTPUT" + else + echo "::warning::The gate wrote no badge files - nothing to publish." + fi + # only the badge files travel to the writing job - not node_modules, not + # anything else the run could have written + - name: Hand the badges over + if: steps.badges.outputs.found == 'true' + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 + with: + name: badges + path: .github/badges/*.json + if-no-files-found: error + retention-days: 1 + + # Publishes the badge files the gate wrote to the `badges` branch. Only on + # main (push, the weekly schedule, a manual run - never a pull request) and + # only after a green gate: main is protected and github-actions[bot] cannot + # bypass that, and the old way round - committing the badges onto the pull + # request branch - started a second set of runs on that commit which waited + # for a maintainer's approval and left the pull request blocked. A failed push + # (a ruleset on the branch) is a warning: the README then keeps showing the + # previous state rather than a wrong one. + publish-badges: + needs: check-abap2ui5 + if: needs.check-abap2ui5.outputs.badges == 'true' && github.event_name != 'pull_request' && github.ref == 'refs/heads/main' + runs-on: ubuntu-latest + timeout-minutes: 5 + permissions: + contents: write + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: badges + path: .github/badges + - name: Publish the badges run: | ls .github/badges/*.json >/dev/null 2>&1 || { echo "::warning::The gate wrote no badge files - nothing to publish."; exit 0; } dir="$RUNNER_TEMP/badges" From a77d5ed1bcdb8680bacc14d691742454b7d1df64 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 12 Oct 2026 09:22:36 +0000 Subject: [PATCH 2/2] Lint with abaplint 2.120.75 Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01Te3BRpRpxNhZAYnrQL6Gdt --- package-lock.json | 8 ++++---- package.json | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/package-lock.json b/package-lock.json index 9cb19e1..af92bf2 100644 --- a/package-lock.json +++ b/package-lock.json @@ -11,7 +11,7 @@ "devDependencies": { "@abap2ui5/linter": "^0.8.5", "@abap2ui5/linter-render": "^0.8.5", - "@abaplint/cli": "^2.120.73" + "@abaplint/cli": "^2.120.75" }, "engines": { "node": ">=22" @@ -189,9 +189,9 @@ "license": "Apache-2.0" }, "node_modules/@abaplint/cli": { - "version": "2.120.73", - "resolved": "https://registry.npmjs.org/@abaplint/cli/-/cli-2.120.73.tgz", - "integrity": "sha512-/CxPAfc3noOvPiJX+GB99st8aN/TB5KmMVfrFDrPKrMuIlzRTv1+Yxs0QIgTj8taUNTZGdyBPriR3mHATZmlpQ==", + "version": "2.120.75", + "resolved": "https://registry.npmjs.org/@abaplint/cli/-/cli-2.120.75.tgz", + "integrity": "sha512-Rf0mQ8PPXsWW3E+Jibu9QcgeWs9zp7k32Lp9/5oxe0Mt/yNAH7iHACyKmfaUVytlGtbaIeioCAjlz8NNgukYMQ==", "dev": true, "license": "MIT", "bin": { diff --git a/package.json b/package.json index b16b829..d64e526 100644 --- a/package.json +++ b/package.json @@ -23,7 +23,7 @@ "devDependencies": { "@abap2ui5/linter": "^0.8.5", "@abap2ui5/linter-render": "^0.8.5", - "@abaplint/cli": "^2.120.73" + "@abaplint/cli": "^2.120.75" }, "engines": { "node": ">=22"