Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/autofix.yml
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@ jobs:
with:
persist-credentials: false
- name: Setup Tools
uses: TanStack/config/.github/setup@e4b48f16568324f76f467aa4c2aac2f05db632c3 # main
uses: TanStack/config/.github/setup@6ddd247a7748fef503de0818293a732f6447fd92 # main
- name: Fix formatting
run: pnpm format
- name: Generate Docs
Expand Down
8 changes: 4 additions & 4 deletions .github/workflows/pr.yml
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@ jobs:
- name: Start Nx Agents
run: npx nx-cloud start-ci-run --distribute-on=".nx/workflows/dynamic-changesets.yaml"
- name: Setup Tools
uses: TanStack/config/.github/setup@e4b48f16568324f76f467aa4c2aac2f05db632c3 # main
uses: TanStack/config/.github/setup@6ddd247a7748fef503de0818293a732f6447fd92 # main
- name: Get base and head commits for `nx affected`
uses: nrwl/nx-set-shas@3e9ad7370203c1e93d109be57f3b72eb0eb511b1 # v4.4.0
with:
Expand All @@ -48,7 +48,7 @@ jobs:
with:
persist-credentials: false
- name: Setup Tools
uses: TanStack/config/.github/setup@e4b48f16568324f76f467aa4c2aac2f05db632c3 # main
uses: TanStack/config/.github/setup@6ddd247a7748fef503de0818293a732f6447fd92 # main
- name: Build Packages
run: pnpm run build:all
- name: Publish Previews
Expand All @@ -74,6 +74,6 @@ jobs:
with:
persist-credentials: false
- name: Setup Tools
uses: TanStack/config/.github/setup@e4b48f16568324f76f467aa4c2aac2f05db632c3 # main
uses: TanStack/config/.github/setup@6ddd247a7748fef503de0818293a732f6447fd92 # main
- name: Changeset Preview
uses: TanStack/config/.github/changeset-preview@e4b48f16568324f76f467aa4c2aac2f05db632c3 # main
uses: TanStack/config/.github/changeset-preview@6ddd247a7748fef503de0818293a732f6447fd92 # main
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚑ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Verify permissions and changeset-preview usage in PR workflow
rg -n -C2 '^\s*permissions:|issues:\s*write|pull-requests:\s*write|changeset-preview@' .github/workflows/pr.yml

Repository: TanStack/store

Length of output: 557


🏁 Script executed:

cat -n .github/workflows/pr.yml

Repository: TanStack/store

Length of output: 3169


Add issues: write permission to the version-preview job.

The changeset-preview action at line 79 posts comments via the GitHub Issues API. Without the issues: write permission, this step fails with a 403 error.

πŸ”§ Suggested fix
   version-preview:
     name: Version Preview
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      issues: write
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
πŸ€– Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/pr.yml at line 79, The version-preview CI job lacks GitHub
Issues write permission causing the changeset-preview step (uses:
TanStack/config/.github/changeset-preview@6ddd247a...) to fail with 403; update
the version-preview job in .github/workflows/pr.yml to add a permissions section
that grants issues: write for the job so the changeset-preview action can post
comments via the Issues API.

4 changes: 2 additions & 2 deletions .github/workflows/release.yml
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,7 @@ jobs:
fetch-depth: 0
persist-credentials: false
- name: Setup Tools
uses: TanStack/config/.github/setup@e4b48f16568324f76f467aa4c2aac2f05db632c3 # main
uses: TanStack/config/.github/setup@6ddd247a7748fef503de0818293a732f6447fd92 # main
- name: Run Tests
run: pnpm run test:ci
- name: Run Changesets (version or publish)
Expand All @@ -43,6 +43,6 @@ jobs:
title: 'ci: Version Packages'
- name: Comment on PRs about release
if: steps.changesets.outputs.published == 'true'
uses: TanStack/config/.github/comment-on-release@e4b48f16568324f76f467aa4c2aac2f05db632c3 # main
uses: TanStack/config/.github/comment-on-release@6ddd247a7748fef503de0818293a732f6447fd92 # main
with:
published-packages: ${{ steps.changesets.outputs.publishedPackages }}
Loading