Skip to content

Conversation

@pransh15
Copy link

Description

Added workflow to add issues to the MDN contributor board.

Motivation

Deliver good-first-issues, accepting PR, and help wanted labelled issues in one board for new contributors.

@pransh15 pransh15 requested review from a team as code owners December 11, 2025 16:07
@pransh15 pransh15 requested review from Rumyra, argl, caugner and pepelsbey and removed request for argl and pepelsbey December 11, 2025 16:07
Comment on lines +10 to +22
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4

- uses: actions/setup-node@v4
with:
node-version: "20"

- run: npm install @octokit/rest

- run: node simple-sync.js
env:
GITHUB_TOKEN: ${{ secrets.PROJECT_TOKEN }}

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read}

Copilot Autofix

AI about 1 month ago

To fix this issue, add an explicit permissions block to the job or at the workflow root specifying the minimal privileges required. Since there are no obvious write actions in the provided workflow (it checks out code, sets up Node.js, installs a package, and runs a script with a token), the minimal recommended starting point from CodeQL is contents: read. To implement the fix, insert a line 'permissions:\n contents: read\n' under the sync job (i.e., below runs-on: ubuntu-latest) in .github/workflows/mdn-contributor-board.yml. This change restricts the job's GITHUB_TOKEN to read-only access to repository contents, mitigating possible privilege escalation risks.

Suggested changeset 1
.github/workflows/mdn-contributor-board.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/mdn-contributor-board.yml b/.github/workflows/mdn-contributor-board.yml
--- a/.github/workflows/mdn-contributor-board.yml
+++ b/.github/workflows/mdn-contributor-board.yml
@@ -8,6 +8,8 @@
 jobs:
   sync:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@v4
 
EOF
@@ -8,6 +8,8 @@
jobs:
sync:
runs-on: ubuntu-latest
permissions:
contents: read
steps:
- uses: actions/checkout@v4

Copilot is powered by AI and may make mistakes. Always verify output.
Copy link
Contributor

@caugner caugner left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@pransh15 Is this workflow really necessary?

Two alternatives:

  1. Use the "Auto-add to project" workflow in the project (see here).
  2. Add a step to the add-issues-to-project workflow in mdn/triagebot (see here).

@caugner
Copy link
Contributor

caugner commented Dec 12, 2025

Note that project workflows can be duplicated:

image

However, given the number of repos, I would recommend letting triagebot handle it. Triagebot can also maintain "Created at" / "Updated at" columns.

@caugner caugner closed this Jan 9, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants