Update Workflows to Version 1.0.1 by epiverse-trace-bot · Pull Request #224 · epiverse-trace/tutorials

epiverse-trace-bot · 2026-01-20T00:54:26Z

🤖 This is an automated build

Update Workflows from sandpaper version 0.16.12 -> 1.0.1

Auto-generated by create-pull-request on 2026-05-12T01:54+00:00

github-actions · 2026-01-20T00:54:37Z

ℹ️ Modified Workflows

This pull request contains modified workflow files and no preview will be created.

Workflow files modified:

.github/workflows/README.md
.github/workflows/docker_apply_cache.yaml
.github/workflows/docker_build_deploy.yaml
.github/workflows/docker_pr_receive.yaml
.github/workflows/pr-close-signal.yaml
.github/workflows/pr-comment.yaml
.github/workflows/pr-preflight.yaml
.github/workflows/sandpaper-version.txt
.github/workflows/update-cache.yaml
.github/workflows/update-workflows.yaml
.github/workflows/workflows-version.txt

If this is not from a trusted source, please inspect the changes for any malicious content.

+    name: "Preflight: PR or Manual Trigger?"
+    runs-on: ubuntu-latest
+    outputs:
+      do-apply: ${{ steps.check.outputs.merged_or_manual }}
+    steps:
+      - name: "Should we run cache application?"
+        id: check
+        run: |
+          if [[ "${{ github.event_name }}" == "workflow_dispatch" ||
+                ("${{ github.ref }}" == "refs/heads/main" && "${{ github.event.action }}" == "closed" && "${{ github.event.pull_request.merged }}" == "true") ]]; then
+            echo "merged_or_manual=true" >> $GITHUB_OUTPUT
+          else
+            echo "This was not a manual trigger and no PR was merged. No action taken."
+            echo "merged_or_manual=false" >> $GITHUB_OUTPUT
+          fi
+        shell: bash
+
+  check-renv:


Add an explicit top-level permissions block in .github/workflows/docker_apply_cache.yaml so all jobs default to least privilege.
Best minimal safe baseline here is:

contents: read (common read access for actions/checkout and repo metadata access)

keep existing job-level check-renv override (id-token: write) unchanged so OIDC still works.

This avoids changing functionality while satisfying CodeQL and documenting intended token scope.
Edit location: near the top of the workflow, after on: block (before concurrency: is ideal).

+    name: "No renv cache used"
+    runs-on: ubuntu-latest
+    needs: check-renv
+    if: needs.check-renv.outputs.renv-needed != 'true'
+    steps:
+      - name: "No renv cache needed"
+        run: echo "No renv cache needed for this lesson"
+
+  renv-cache-available:


Add an explicit top-level permissions block in .github/workflows/docker_apply_cache.yaml so all jobs without their own permissions are least-privileged by default.

Best single fix without changing behavior:

Insert at workflow root (after on: block, before concurrency: is a clean location):

permissions:

contents: read

Keep existing job-level permissions blocks unchanged (e.g., check-renv with id-token: write) so jobs needing elevated/specific scopes still work.

This addresses the CodeQL finding for no-renv-cache-used and any other jobs lacking explicit permissions while preserving current functionality.

+    name: "renv cache available"
+    runs-on: ubuntu-latest
+    needs: check-renv
+    if: needs.check-renv.outputs.renv-cache-available == 'true'
+    steps:
+      - name: "renv cache available"
+        run: echo "renv cache available for this lesson"
+
+  update-renv-cache:


+    name: "Preflight: Schedule, Push, or PR?"
+    runs-on: ubuntu-latest
+    outputs:
+      do-build: ${{ steps.build-check.outputs.do-build }}
+      renv-needed: ${{ steps.build-check.outputs.renv-needed }}
+      renv-cache-hashsum: ${{ steps.build-check.outputs.renv-cache-hashsum }}
+      workbench-container-file-exists: ${{ steps.wb-vers.outputs.workbench-container-file-exists }}
+      wb-vers: ${{ steps.wb-vers.outputs.container-version }}
+      last-wb-vers: ${{ steps.wb-vers.outputs.last-container-version }}
+      workbench-update: ${{ steps.wb-vers.outputs.workbench-update }}
+    env:
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+    steps:
+      - name: "Should we run build and deploy?"
+        id: build-check
+        uses: carpentries/actions/build-preflight@main
+
+      - name: "Checkout Lesson"
+        if: steps.build-check.outputs.do-build == 'true'
+        uses: actions/checkout@v4
+
+      - name: "Get container version info"
+        id: wb-vers
+        if: steps.build-check.outputs.do-build == 'true'
+        uses: carpentries/actions/container-version@main
+        with:
+          WORKBENCH_TAG: ${{ vars.WORKBENCH_TAG }}
+          renv-needed: ${{ steps.build-check.outputs.renv-needed }}
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+  full-build:


Add an explicit permissions block to the preflight job in .github/workflows/docker_build_deploy.yaml, scoped to the minimum needed. Based on the shown steps (actions/checkout and read/check actions), the best minimal permission is:

contents: read

This keeps behavior unchanged while satisfying least privilege and CodeQL.
Change location: directly under runs-on (or before outputs) in the preflight job.

No imports, methods, or dependencies are required.

@@ -33,48 +52,42 @@ jobs:
            echo "ok=false" >> $GITHUB_OUTPUT
            echo "Not Running Today"
          fi
+        shell: bash

-  check_renv:
-    name: "Check if We Need {renv}"
-    runs-on: ubuntu-22.04
+  check-renv:
+    name: "Check If We Need {renv}"
+    runs-on: ubuntu-latest
    needs: preflight
-    if: ${{ needs.preflight.outputs.ok == 'true'}}
+    if: ${{ needs.preflight.outputs.ok == 'true' }}


Add a top-level permissions block to .github/workflows/update-cache.yaml so jobs without their own permissions (preflight, check-renv) run with least privilege explicitly set. Keep the existing update_cache job-level permissions unchanged so it retains required write scopes.

Best single fix:

In .github/workflows/update-cache.yaml, insert a root-level block right after the on: section (before env:):

permissions:

contents: read

This makes default token access explicit and restricted for all jobs.

update_cache already has a job-level permissions block, which will override root defaults for that job, so existing functionality is preserved.

No imports, methods, or dependency changes are needed.

+    name: "Record Caching Status"
+    runs-on: ubuntu-latest
+    needs: [check-renv, update-renv-cache]
+    if: always()
+    env:
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+    steps:
+      - name: "Record cache result"
+
+        run: |
+          echo "${{ needs.update-renv-cache.result == 'success' || needs.check-renv.outputs.renv-cache-available == 'true' || 'false' }}" > ${{ github.workspace }}/apply-cache-result
+        shell: bash
+
+      - name: "Upload cache result"
+        uses: actions/upload-artifact@v4
+        with:
+          name: apply-cache-result
+          path: ${{ github.workspace }}/apply-cache-result


Add an explicit permissions block at the workflow root in .github/workflows/docker_apply_cache.yaml so all jobs inherit least-privilege defaults unless overridden.
The best single fix without changing behavior is to add:

contents: read (safe baseline for checkout/read repo metadata)

id-token: write (required for OIDC in aws-actions/configure-aws-credentials@v6)

Place this block after on: (or before jobs:). This keeps existing workflow logic intact while ensuring explicit token scoping and preserving the OIDC AWS credential step.

epiverse-trace-bot added the type: template and tools label Jan 20, 2026

github-advanced-security AI found potential problems Jan 20, 2026

View reviewed changes

epiverse-trace-bot force-pushed the update/workflows branch from 4ddb376 to 9215a89 Compare January 27, 2026 00:58

epiverse-trace-bot changed the title ~~Update Workflows to Version 0.18.3~~ Update Workflows to Version 0.18.4 Jan 27, 2026

epiverse-trace-bot changed the title ~~Update Workflows to Version 0.18.4~~ Update Workflows to Version 0.18.5 Feb 3, 2026

epiverse-trace-bot force-pushed the update/workflows branch from 9215a89 to 885e44d Compare February 3, 2026 01:07

github-advanced-security AI found potential problems Feb 3, 2026

View reviewed changes

epiverse-trace-bot force-pushed the update/workflows branch from 885e44d to b8ae4ae Compare February 10, 2026 01:17

epiverse-trace-bot changed the title ~~Update Workflows to Version 0.18.5~~ Update Workflows to Version 1.0.0 Mar 3, 2026

epiverse-trace-bot force-pushed the update/workflows branch from b8ae4ae to f29abad Compare March 3, 2026 01:07

epiverse-trace-bot force-pushed the update/workflows branch from f29abad to 92bfc85 Compare March 24, 2026 01:04

epiverse-trace-bot force-pushed the update/workflows branch from 92bfc85 to be683d4 Compare April 7, 2026 01:16

[actions] update sandpaper workflow to version 1.0.1

4be5f54

epiverse-trace-bot changed the title ~~Update Workflows to Version 1.0.0~~ Update Workflows to Version 1.0.1 Apr 21, 2026

epiverse-trace-bot force-pushed the update/workflows branch from be683d4 to 4be5f54 Compare April 21, 2026 01:22

@@ -13,6 +13,9 @@
                 branches:
                   - main
+            permissions:
+              contents: read
             # queue cache runs
             concurrency:
               group: docker-apply-cache

@@ -13,6 +13,9 @@
                 branches:
                   - main
+            permissions:
+              contents: read
             # queue cache runs
             concurrency:
               group: docker-apply-cache

@@ -25,6 +25,9 @@
                     default: false
                     type: boolean
+            permissions:
+              contents: read
             env:
               LOCKFILE_CACHE_GEN: ${{ vars.LOCKFILE_CACHE_GEN || github.event.inputs.generate-cache || 'false' }}
               FORCE_RENV_INIT: ${{ vars.FORCE_RENV_INIT || github.event.inputs.force-renv-init || 'false' }}

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update Workflows to Version 1.0.1#224

Update Workflows to Version 1.0.1#224
epiverse-trace-bot wants to merge 1 commit into
mainfrom
update/workflows

epiverse-trace-bot commented Jan 20, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jan 20, 2026 •

edited

Loading

Uh oh!

Check warning

Copilot Autofix

Check warning

Copilot Autofix

Check warning

Uh oh!

Check warning

Copilot Autofix

Check warning

Copilot Autofix

Check warning

Copilot Autofix

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

epiverse-trace-bot commented Jan 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jan 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

ℹ️ Modified Workflows

Uh oh!

Check warning

Copilot Autofix

Check warning

Copilot Autofix

Check warning

Uh oh!

Check warning

Copilot Autofix

Check warning

Copilot Autofix

Check warning

Copilot Autofix

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

epiverse-trace-bot commented Jan 20, 2026 •

edited

Loading

github-actions Bot commented Jan 20, 2026 •

edited

Loading