From 4e7eaa02255063e9f5cfb46e368706d8779e51df Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=C3=81rp=C3=A1d=20Csepi?= Date: Fri, 4 Sep 2026 15:56:51 +0200 Subject: [PATCH 1/3] chore: bump packages MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Árpád Csepi --- package-lock.json | 12 ++++++------ package.json | 2 +- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/package-lock.json b/package-lock.json index 4af44a5..3d2ccc1 100644 --- a/package-lock.json +++ b/package-lock.json @@ -2774,9 +2774,9 @@ "license": "MIT" }, "node_modules/fast-uri": { - "version": "3.1.2", - "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.2.tgz", - "integrity": "sha512-rVjf7ArG3LTk+FS6Yw81V1DLuZl1bRbNrev6Tmd/9RaroeeRRJhAt7jg/6YFxbvAQXUCavSoZhPPj6oOx+5KjQ==", + "version": "3.1.7", + "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.7.tgz", + "integrity": "sha512-dOvZVzjdZdz7phd9v6jCbwxrBW3fK6n8Rc0CtdmM4bumzMnxywBYhuph6J819RRw/ku+rLbelwfMunktuzVVHg==", "dev": true, "funding": [ { @@ -3879,9 +3879,9 @@ } }, "node_modules/protobufjs": { - "version": "7.6.4", - "resolved": "https://registry.npmjs.org/protobufjs/-/protobufjs-7.6.4.tgz", - "integrity": "sha512-RJJPTTpvFfHcWLkIa2JFWK4XvtSzS0yEWDmunqHXli1h3JlkbcQZXDZdcWxv+JK3Xsl5/UFDPZ0iGm7DAengYw==", + "version": "7.6.6", + "resolved": "https://registry.npmjs.org/protobufjs/-/protobufjs-7.6.6.tgz", + "integrity": "sha512-dYDWdjSl5RNb7SgPxGQcRU+GtvP7s2fpkrY0r432PcOIaZ0/rBcxEZnQN67iJhFuQiVw754JDoPruPCNdGsbjg==", "hasInstallScript": true, "license": "BSD-3-Clause", "dependencies": { diff --git a/package.json b/package.json index de88c2f..252458d 100644 --- a/package.json +++ b/package.json @@ -86,6 +86,6 @@ "author": "", "allowScripts": { "fsevents@2.3.3": true, - "protobufjs@7.6.4": true + "protobufjs@7.6.6": true } } From 32003a0ea589b22eb730c990cd2e4c9ef62998cf Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=C3=81rp=C3=A1d=20Csepi?= Date: Fri, 4 Sep 2026 15:57:03 +0200 Subject: [PATCH 2/3] ci: improve token permission handling MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Árpád Csepi --- .github/workflows/ci.yaml | 13 +++++++++---- .github/workflows/codeql.yml | 7 +++++-- .github/workflows/dependencies.yaml | 5 +++++ 3 files changed, 19 insertions(+), 6 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index f56bff4..e0db102 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -22,11 +22,9 @@ on: type: string description: "Override the tag of the dir-ctl Docker image to use in the tests." +# Declare default permissions as read-only; jobs that need more request it explicitly. permissions: - contents: write - packages: write - id-token: write - pull-requests: write + contents: read concurrency: group: ${{ github.workflow }}-${{ github.ref }} @@ -97,6 +95,10 @@ jobs: name: Test needs: - changes + permissions: + id-token: write + contents: read + packages: read uses: ./.github/workflows/reusable-test-sdk.yaml with: dir_chart_version: ${{ inputs.dir_chart_version }} @@ -108,6 +110,9 @@ jobs: needs: - lint - test + permissions: + contents: read + id-token: write # Required for npm OIDC trusted publishing uses: ./.github/workflows/reusable-release-sdk.yaml success: diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 95ed336..d66a5d7 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -3,6 +3,9 @@ name: "CodeQL Advanced" +# Declare default permissions as none; the analyze job grants exactly what it needs. +permissions: {} + on: push: branches: @@ -51,12 +54,12 @@ jobs: echo "📦 Installing JavaScript/TypeScript dependencies..." # Install dependencies for JavaScript SDK if [ -f "package.json" ]; then - npm ci || npm install + npm ci fi # Install dependencies for examples if [ -f "examples/package.json" ]; then cd examples - npm ci || npm install + npm ci cd .. fi echo "✅ JavaScript/TypeScript dependencies installed" diff --git a/.github/workflows/dependencies.yaml b/.github/workflows/dependencies.yaml index e7fa979..813b42e 100644 --- a/.github/workflows/dependencies.yaml +++ b/.github/workflows/dependencies.yaml @@ -5,6 +5,11 @@ on: schedule: - cron: "0 */6 * * *" +# Declare default permissions as read-only; the job authenticates via the +# GitHub App token instead of relying on the default GITHUB_TOKEN. +permissions: + contents: read + jobs: renovate: name: Renovate Sync From be2bce06daa127578224cf91bd45d8808310c9c1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=C3=81rp=C3=A1d=20Csepi?= Date: Fri, 4 Sep 2026 16:02:03 +0200 Subject: [PATCH 3/3] fix(renovate): sync lockfile at any time MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Árpád Csepi --- renovate.json | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/renovate.json b/renovate.json index 6c0394a..80c67a9 100644 --- a/renovate.json +++ b/renovate.json @@ -59,7 +59,10 @@ ], "osvVulnerabilityAlerts": true, "lockFileMaintenance": { - "enabled": true + "enabled": true, + "schedule": [ + "at any time" + ] }, "packageRules": [ {