Potential fix for code scanning alert no. 1: Workflow does not contain permissions#30
Merged
Conversation
…n permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
BigSimmo
marked this pull request as ready for review
June 14, 2026 09:18
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
2 tasks
BigSimmo
added a commit
that referenced
this pull request
Jul 22, 2026
BigSimmo
added a commit
that referenced
this pull request
Jul 22, 2026
5 tasks
8 tasks
BigSimmo
added a commit
that referenced
this pull request
Jul 25, 2026
BigSimmo
added a commit
that referenced
this pull request
Jul 25, 2026
cursor Bot
pushed a commit
that referenced
this pull request
Jul 25, 2026
#1177) * fix(#30): keep admission/discharge wide-tier aliases disjoint A single Admission-to-Discharge document was listed under both AdmissionCommunityPts and Discharge, so expectedFileCoverage could set allHit true from one retrieved source. Drop those titles from the admission side and add fail-closed contract tests. Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com> * fix(#75): paginate search-scope label enumeration past 1k rows A single document_labels query could silently drop matches beyond the Supabase 1,000-row response cap. Load labels in deterministic document-batched pages with stable ordering and abort propagation, and cover multi-page >1000 enumeration in unit contracts. Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com> * issues: mark #30 and #75 done Archive the wide-tier dual-alias false-pass and search-scope 1k label truncation fixes; remove the composite recommended-queue row. Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com> * fix: harden distinct-slot matching and label page budget expectedFileCoverage now consumes each retrieved top-file at most once so a combo-titled source cannot false-pass multi-slot allHit. Label enumeration fails closed after a bounded page budget instead of looping forever on a stuck full-page API response. Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com> * style: prettier-format search-correctness follow-up files Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com> * ci: sync accurate PR #1177 policy body template Replace the stale search-performance PR_POLICY_BODY.md leftover on main so Sync PR policy body stops overwriting this PR with unrelated summary text. Template will be deleted in a follow-up commit after the sync job applies it. Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com> * ci: apply correct PR #1177 policy body for sync Temporary template so Sync PR policy body replaces the stale search-performance description. Delete in the next commit before merge. Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com> * ci: remove PR_POLICY_BODY.md after sync Keep the corrected GitHub PR description without leaving a template on main that would overwrite later PR bodies (same cleanup pattern as #942 / #953). Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com> * docs: record PR #1177 review and hardening outcome Append branch-review-ledger entry for the #30/#75 assessment, distinct-slot/page-budget fixes, and PR_POLICY_BODY cleanup. Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com> * docs: supersede #1177 ledger tip after PR_POLICY_BODY cleanup Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com> * fix(docs): encode ledger em-dashes as UTF-8 Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>
cursor Bot
pushed a commit
that referenced
this pull request
Jul 25, 2026
* feat(ui): streamline clinical sidebar navigation * test(ui): align therapy wiring with sidebar scope * test(ui): align favourites sidebar contract with six-item rail Assert the canonical sidebarToolItems list (Medications/Factsheets) instead of main's retired primarySidebarToolIds Forms/Therapy filter. Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com> * style: format favourites sidebar contract test Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com> * test(ui): fix guide/settings helpers after sidebar streamlining Tighten mobile menu assertions so Close Clinical Guide menu is not treated as a Guide affordance, and make openGuide reuse an already-open Settings dialog (tablet rail + restore path) instead of clicking through an overlay. Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com> * issues: update #66 with sidebar land proof status Record feature-branch proof on PR #1174 (focused suites, verify:pr-local, ensure spot-check, verify:ui). Remaining work is merge to main. Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com> * issues: pin #66 proof SHA to ledger tip Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com> * issues: align #66 tip SHA with branch HEAD Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com> * docs: pin #66 proof to content SHA and record review ledger Cite d97c11e as the content-proof commit for the six-item sidebar land so later ledger-only tip moves do not churn the issue row. Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com> * issues: clean #66 proof wording Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com> * fix(ci): format outstanding issues ledger * docs: record PR 1174 maintenance * style: prettier-format outstanding-issues after main merge Co-authored-by: Cursor <cursoragent@cursor.com> * fix(test): use RegExp name matcher for Guide & help query Avoid ByRoleOptions exact overload mismatch in favourites-auth-gate DOM test. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(test): disambiguate Medications link in prescribing smoke Use exact name + first() so rail and breadcrumb links do not trip strict mode. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(docs): remove conflict markers from outstanding-issues Take main's #30/#75 closures and keep the #66 six-item progress row. Co-authored-by: Cursor <cursoragent@cursor.com> * docs(review): append babysit ledger rows for #1177 merge Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>
This was referenced Jul 25, 2026
cursor Bot
pushed a commit
that referenced
this pull request
Jul 25, 2026
* docs(issues): close stale #66/#67 after main landings #66 is on origin/main via PR #1174; #67 was fixed in PR #1191 by running the preflight JSON contract in-process. Also drop already- resolved #30/#75 from the recommended queue and renumber. Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com> * docs: pin branch-review ledger SHA for #66/#67 closeout Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com> --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>
cursor Bot
pushed a commit
that referenced
this pull request
Jul 25, 2026
…mplate cleanup (#1204) * fix(#30): match expected files by distinct document identity The merged #30 fix assigned each expectation to a distinct source position. Positions are not documents: answer.citations carries one entry per cited chunk, so a single combo-titled document arrives several times and could still fill both comparison slots. First-come assignment was also order-dependent -- a document matching two expectations could consume the only source a narrower expectation needed, so the same inputs produced different allHit results depending on expectedFiles order. Dedupe the window by document text and assign sources by maximum bipartite matching, so coverage is both distinct-by-document and order-independent. RAG impact: no retrieval behaviour change -- eval matching only. Also append label rows in place when building labelsByDocument; paging past the 1,000-row cap (#75) means that loop now sees the full label set, where per-row array rebuilds were quadratic. Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com> * chore: remove leftover PR_POLICY_BODY.md after #1153 The sync-pr-policy-body CI job overwrites a pull request description with this file whenever it exists on the head commit. The copy on main holds the audit-remediation body from #1153, so every branch cut from main silently inherits that description -- which is how #1177 lost its own body. Remove it, as #953 did after #939; the job skips cleanly when no template is present. Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com> * docs(issues): record the #30 follow-up and open #80 Drop the stale queue row for #30/#75, which stayed in the recommended queue after both were archived, note the distinct-identity hardening on the #30 archive row, and open #80 to re-test the removed admission-to-discharge widening under approved eval evidence. Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com> * docs(ledger): append #1177 SHA correction and this review record Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com> --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>
4 tasks
cursor Bot
pushed a commit
that referenced
this pull request
Jul 25, 2026
…1215) * test(#30): generalize the alias-slot disjointness guard The existing contracts pin the admission/discharge pair by name, so a future multi-slot case -- or a widening of a different alias tier -- could reintroduce the #30 defect without any test going red. Drive both invariants off the real eval cases instead: no expectation of a multi-slot case may share alias values with another slot of the same case, and no single document may satisfy every slot of any multi-slot case. The second holds independently of the alias tables, so it stays meaningful if the tables are widened again. RAG impact: no retrieval behaviour change -- test-only. Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com> * docs(issues): open #81 for the PR #1196 alias conflict PR #1196 re-adds two admission-to-discharge titles to the wide-tier AdmissionCommunityPts list, which would revert the #30 tightening. Its other conflicts include protected RAG surfaces, so record how to reconcile it rather than leaving that in chat context. Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com> --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
This was referenced Jul 25, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Potential fix for https://github.com/BigSimmo/Database/security/code-scanning/1
Add an explicit
permissionsblock to the workflow so theGITHUB_TOKENis restricted regardless of repository/org defaults.Best fix here: define workflow-level permissions with
contents: read, since the singleverifyjob uses checkout and local CI commands only.Where to change:
.github/workflows/ci.yml, near the top-level keys, immediately after theon:triggers and beforejobs:.What to add:
No imports, methods, or additional definitions are required.
Suggested fixes powered by Copilot Autofix. Review carefully before merging.