Skip to content

Potential fix for code scanning alert no. 1: Workflow does not contain permissions#30

Merged
BigSimmo merged 1 commit into
mainfrom
alert-autofix-1
Jun 14, 2026
Merged

Potential fix for code scanning alert no. 1: Workflow does not contain permissions#30
BigSimmo merged 1 commit into
mainfrom
alert-autofix-1

Conversation

@BigSimmo

Copy link
Copy Markdown
Owner

Potential fix for https://github.com/BigSimmo/Database/security/code-scanning/1

Add an explicit permissions block to the workflow so the GITHUB_TOKEN is restricted regardless of repository/org defaults.
Best fix here: define workflow-level permissions with contents: read, since the single verify job uses checkout and local CI commands only.

Where to change: .github/workflows/ci.yml, near the top-level keys, immediately after the on: triggers and before jobs:.

What to add:

permissions:
  contents: read

No imports, methods, or additional definitions are required.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

…n permissions

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
@BigSimmo
BigSimmo marked this pull request as ready for review June 14, 2026 09:18
@chatgpt-codex-connector

Copy link
Copy Markdown

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

@BigSimmo
BigSimmo merged commit 83242dd into main Jun 14, 2026
8 of 11 checks passed
@BigSimmo
BigSimmo deleted the alert-autofix-1 branch June 14, 2026 11:04
cursor Bot pushed a commit that referenced this pull request Jul 24, 2026
Archive the wide-tier dual-alias false-pass and search-scope 1k label
truncation fixes; remove the composite recommended-queue row.

Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>
cursor Bot pushed a commit that referenced this pull request Jul 24, 2026
Append branch-review-ledger entry for the #30/#75 assessment,
distinct-slot/page-budget fixes, and PR_POLICY_BODY cleanup.

Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>
BigSimmo added a commit that referenced this pull request Jul 25, 2026
Keep loadScopeLabels batching, require ScopeLabelRow.id, close #30/#75
in outstanding-issues, and align order() test expectations with composite
label pagination.

Co-authored-by: Cursor <cursoragent@cursor.com>
cursor Bot pushed a commit that referenced this pull request Jul 25, 2026
#1177)

* fix(#30): keep admission/discharge wide-tier aliases disjoint

A single Admission-to-Discharge document was listed under both
AdmissionCommunityPts and Discharge, so expectedFileCoverage could set
allHit true from one retrieved source. Drop those titles from the
admission side and add fail-closed contract tests.

Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>

* fix(#75): paginate search-scope label enumeration past 1k rows

A single document_labels query could silently drop matches beyond the
Supabase 1,000-row response cap. Load labels in deterministic
document-batched pages with stable ordering and abort propagation, and
cover multi-page >1000 enumeration in unit contracts.

Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>

* issues: mark #30 and #75 done

Archive the wide-tier dual-alias false-pass and search-scope 1k label
truncation fixes; remove the composite recommended-queue row.

Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>

* fix: harden distinct-slot matching and label page budget

expectedFileCoverage now consumes each retrieved top-file at most once
so a combo-titled source cannot false-pass multi-slot allHit. Label
enumeration fails closed after a bounded page budget instead of looping
forever on a stuck full-page API response.

Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>

* style: prettier-format search-correctness follow-up files

Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>

* ci: sync accurate PR #1177 policy body template

Replace the stale search-performance PR_POLICY_BODY.md leftover on
main so Sync PR policy body stops overwriting this PR with unrelated
summary text. Template will be deleted in a follow-up commit after
the sync job applies it.

Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>

* ci: apply correct PR #1177 policy body for sync

Temporary template so Sync PR policy body replaces the stale
search-performance description. Delete in the next commit before merge.

Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>

* ci: remove PR_POLICY_BODY.md after sync

Keep the corrected GitHub PR description without leaving a template
on main that would overwrite later PR bodies (same cleanup pattern
as #942 / #953).

Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>

* docs: record PR #1177 review and hardening outcome

Append branch-review-ledger entry for the #30/#75 assessment,
distinct-slot/page-budget fixes, and PR_POLICY_BODY cleanup.

Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>

* docs: supersede #1177 ledger tip after PR_POLICY_BODY cleanup

Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>

* fix(docs): encode ledger em-dashes as UTF-8

Co-authored-by: Cursor <cursoragent@cursor.com>

---------

Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>
BigSimmo added a commit that referenced this pull request Jul 25, 2026
Take main's #30/#75 closures and keep the #66 six-item progress row.

Co-authored-by: Cursor <cursoragent@cursor.com>
cursor Bot pushed a commit that referenced this pull request Jul 25, 2026
* feat(ui): streamline clinical sidebar navigation

* test(ui): align therapy wiring with sidebar scope

* test(ui): align favourites sidebar contract with six-item rail

Assert the canonical sidebarToolItems list (Medications/Factsheets) instead
of main's retired primarySidebarToolIds Forms/Therapy filter.

Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>

* style: format favourites sidebar contract test

Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>

* test(ui): fix guide/settings helpers after sidebar streamlining

Tighten mobile menu assertions so Close Clinical Guide menu is not
treated as a Guide affordance, and make openGuide reuse an already-open
Settings dialog (tablet rail + restore path) instead of clicking through
an overlay.

Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>

* issues: update #66 with sidebar land proof status

Record feature-branch proof on PR #1174 (focused suites, verify:pr-local,
ensure spot-check, verify:ui). Remaining work is merge to main.

Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>

* issues: pin #66 proof SHA to ledger tip

Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>

* issues: align #66 tip SHA with branch HEAD

Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>

* docs: pin #66 proof to content SHA and record review ledger

Cite d97c11e as the content-proof commit for the six-item sidebar land
so later ledger-only tip moves do not churn the issue row.

Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>

* issues: clean #66 proof wording

Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>

* fix(ci): format outstanding issues ledger

* docs: record PR 1174 maintenance

* style: prettier-format outstanding-issues after main merge

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(test): use RegExp name matcher for Guide & help query

Avoid ByRoleOptions exact overload mismatch in favourites-auth-gate DOM test.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(test): disambiguate Medications link in prescribing smoke

Use exact name + first() so rail and breadcrumb links do not trip strict mode.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(docs): remove conflict markers from outstanding-issues

Take main's #30/#75 closures and keep the #66 six-item progress row.

Co-authored-by: Cursor <cursoragent@cursor.com>

* docs(review): append babysit ledger rows for #1177 merge

Co-authored-by: Cursor <cursoragent@cursor.com>

---------

Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>
cursor Bot pushed a commit that referenced this pull request Jul 25, 2026
* docs(issues): close stale #66/#67 after main landings

#66 is on origin/main via PR #1174; #67 was fixed in PR #1191 by
running the preflight JSON contract in-process. Also drop already-
resolved #30/#75 from the recommended queue and renumber.

Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>

* docs: pin branch-review ledger SHA for #66/#67 closeout

Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>

---------

Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>
cursor Bot pushed a commit that referenced this pull request Jul 25, 2026
…mplate cleanup (#1204)

* fix(#30): match expected files by distinct document identity

The merged #30 fix assigned each expectation to a distinct source
position. Positions are not documents: answer.citations carries one
entry per cited chunk, so a single combo-titled document arrives
several times and could still fill both comparison slots. First-come
assignment was also order-dependent -- a document matching two
expectations could consume the only source a narrower expectation
needed, so the same inputs produced different allHit results depending
on expectedFiles order.

Dedupe the window by document text and assign sources by maximum
bipartite matching, so coverage is both distinct-by-document and
order-independent.

RAG impact: no retrieval behaviour change -- eval matching only.

Also append label rows in place when building labelsByDocument; paging
past the 1,000-row cap (#75) means that loop now sees the full label
set, where per-row array rebuilds were quadratic.

Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>

* chore: remove leftover PR_POLICY_BODY.md after #1153

The sync-pr-policy-body CI job overwrites a pull request description
with this file whenever it exists on the head commit. The copy on main
holds the audit-remediation body from #1153, so every branch cut from
main silently inherits that description -- which is how #1177 lost its
own body. Remove it, as #953 did after #939; the job skips cleanly when
no template is present.

Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>

* docs(issues): record the #30 follow-up and open #80

Drop the stale queue row for #30/#75, which stayed in the recommended
queue after both were archived, note the distinct-identity hardening on
the #30 archive row, and open #80 to re-test the removed
admission-to-discharge widening under approved eval evidence.

Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>

* docs(ledger): append #1177 SHA correction and this review record

Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>

---------

Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>
cursor Bot pushed a commit that referenced this pull request Jul 25, 2026
…1215)

* test(#30): generalize the alias-slot disjointness guard

The existing contracts pin the admission/discharge pair by name, so a
future multi-slot case -- or a widening of a different alias tier --
could reintroduce the #30 defect without any test going red.

Drive both invariants off the real eval cases instead: no expectation
of a multi-slot case may share alias values with another slot of the
same case, and no single document may satisfy every slot of any
multi-slot case. The second holds independently of the alias tables,
so it stays meaningful if the tables are widened again.

RAG impact: no retrieval behaviour change -- test-only.

Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>

* docs(issues): open #81 for the PR #1196 alias conflict

PR #1196 re-adds two admission-to-discharge titles to the wide-tier
AdmissionCommunityPts list, which would revert the #30 tightening. Its
other conflicts include protected RAG surfaces, so record how to
reconcile it rather than leaving that in chat context.

Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>

---------

Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant