Skip to content

Chore add main branch pr source validation #167

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
vicheey wants to merge 18 commits into from
Closed

Chore add main branch pr source validation #167

Changes from all commits
Commits
Show all changes
18 commits
Select commit Hold shift + click to select a range
b57d8f4
Merge pull request #53 from aws/develop
valerena Sep 29, 2021
49c35f6
v1.3 release
valerena Nov 15, 2021
43a7a09
Merge changes for v1.8 release
valerena Sep 22, 2022
5a79e1e
Merge changes for v1.9 release
valerena Nov 1, 2022
9de974f
Merge changes for v1.11 release
valerena May 3, 2023
23f8171
Merge changes for v1.12 release
valerena Jun 8, 2023
c6779f7
Merge changes for v1.15 release
valerena Nov 30, 2023
25a2eac
Merge changes for v1.17 release
valerena Mar 20, 2024
c99378b
Merge changes for v1.19 release
valerena May 14, 2024
394ab66
Merge the check for vulnerabilities
valerena Jun 6, 2024
566545f
Merge pull request #144 from aws/develop
roger-zhangg Apr 23, 2025
9dc822b
Release 1.27
valerena Aug 11, 2025
eac2355
feat: Add support for multi-tenancy
licjun Nov 19, 2025
696d97a
Merge commit 'develop' to 'main' multi-tenancy
valerena Dec 1, 2025
07bf88e
Merge pull request #159 from aws/develop
valerena Dec 1, 2025
9e9cceb
Merge develop into main for release (#164)
seshubaws Feb 10, 2026
a90cb39
Merge pull request #166 from aws/develop
vicheey Feb 12, 2026
a38bd50
chore: add pr branch validation working for main branch
vicheey Feb 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 20 additions & 0 deletions .github/workflows/validate-branch-into-main.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,20 @@
name: Validate PR Branch into Main

on:
pull_request:
branches:
- main

jobs:
validate-pr-branch:
runs-on: ubuntu-latest
steps:
- name: Check source branch
run: |
SOURCE_BRANCH="${{ github.head_ref }}"
if [[ "$SOURCE_BRANCH" != "develop" ]]; then
echo "Error: Only pull requests from develop branch are allowed into main"
echo "Current source branch ($SOURCE_BRANCH)."
exit 1
fi
echo "Source branch is develop - merge allowed"
Comment on lines +10 to +20

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {}

Copilot Autofix

AI 2 days ago

In general, the fix is to explicitly declare a permissions block in the workflow (either at the root or per job) that grants only the minimal required permissions for the GITHUB_TOKEN. Since this workflow only reads github.head_ref (context data) and runs a shell script without calling the GitHub API or modifying repository resources, it does not need any special write permissions. The safest minimal configuration is to set all token permissions to none at the job level for validate-pr-branch.

The best fix without changing existing functionality is to add a permissions: {} or, more explicitly, permissions: {} with specific keys. GitHub supports permissions: read-all / write-all, or a fine-grained map; setting everything to none is achieved by setting all scopes to none or using permissions: {} with contents: read. However, because this job does not need to read repository contents via token either, we can simply set permissions: {} to read-all? That’s not correct; the recommended minimal restrictive pattern for a workflow that does not need the token is permissions: {}? Actually the canonical way is permissions: {}? To be explicit and future-proof, we should set the job-level permissions to read-all or to specific read scopes. Since the job uses no API, we can completely disable the token with permissions: {} and permissions: contents: read is still more permissive than needed. GitHub’s documented method to fully disable GITHUB_TOKEN is permissions: {} combined with permissions: {}? To avoid ambiguity and stay strictly within well-documented patterns, we’ll set permissions: read-all to enforce read-only, which is the recommended minimal starting point in many security guides. That ensures the token cannot perform write operations while remaining fully compatible with typical Actions behavior.

Concretely, in .github/workflows/validate-branch-into-main.yaml, under the validate-pr-branch job (same indentation level as runs-on), add:

    permissions:
      contents: read

or read-all. To keep it minimal and explicit, use contents: read. This limits repository contents access to read-only and removes default write powers. No imports or extra methods are needed; it’s a pure YAML change.

Suggested changeset 1
.github/workflows/validate-branch-into-main.yaml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/validate-branch-into-main.yaml b/.github/workflows/validate-branch-into-main.yaml
--- a/.github/workflows/validate-branch-into-main.yaml
+++ b/.github/workflows/validate-branch-into-main.yaml
@@ -8,6 +8,8 @@
 jobs:
   validate-pr-branch:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Check source branch
         run: |
EOF
@@ -8,6 +8,8 @@
jobs:
validate-pr-branch:
runs-on: ubuntu-latest
permissions:
contents: read
steps:
- name: Check source branch
run: |
Copilot is powered by AI and may make mistakes. Always verify output.