Skip to content

Conversation

@Sidnioulz
Copy link
Member

@Sidnioulz Sidnioulz commented Sep 22, 2025

📦 Published PR as canary version: 9.0.2--canary.15.3e3d0e9.0

✨ Test out this PR locally via:

npm install @storybook/addon-queryparams@9.0.2--canary.15.3e3d0e9.0
# or 
yarn add @storybook/addon-queryparams@9.0.2--canary.15.3e3d0e9.0

Comment on lines 7 to 28
runs-on: ubuntu-latest
strategy:
matrix:
node-version: [22]
steps:
- name: Checkout
uses: actions/checkout@v4
with:
fetch-depth: 0
- name: Install pnpm
uses: pnpm/action-setup@v4
- name: Use Node.js ${{ matrix.node-version }}
uses: actions/setup-node@v4
with:
node-version: ${{ matrix.node-version }}
cache: 'pnpm'
- name: Install dependencies
run: pnpm install
- name: Check for linter errors
run: pnpm lint

test:

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read}

Copilot Autofix

AI 3 days ago

To fix this issue, add the permissions key to the workflow file to explicitly set the minimum permissions required. Since neither the lint nor the build job needs to perform write operations (such as creating issues, pushing code, etc.), contents: read is a sufficient and secure default. Add this at the workflow root, after the name and before on, so it applies to all jobs. No other code or configuration changes are needed in this case.


Suggested changeset 1
.github/workflows/continuous-integration.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/continuous-integration.yml b/.github/workflows/continuous-integration.yml
--- a/.github/workflows/continuous-integration.yml
+++ b/.github/workflows/continuous-integration.yml
@@ -1,4 +1,6 @@
 name: CI
+permissions:
+  contents: read
 
 on: [push, pull_request]
 
EOF
@@ -1,4 +1,6 @@
name: CI
permissions:
contents: read

on: [push, pull_request]

Copilot is powered by AI and may make mistakes. Always verify output.
@Sidnioulz Sidnioulz force-pushed the setup branch 3 times, most recently from bf4f17d to 81eaa24 Compare October 29, 2025 16:16
Signed-off-by: Steve Dodier-Lazaro <sidnioulz@gmail.com>
BREAKING CHANGE: This addon is now an ESM-only package, and requires Storybook 10 or newer.

Signed-off-by: Steve Dodier-Lazaro <sidnioulz@gmail.com>
Signed-off-by: Steve Dodier-Lazaro <sidnioulz@gmail.com>
Comment on lines +29 to +48
runs-on: ubuntu-latest
strategy:
matrix:
node-version: [22]
steps:
- name: Checkout
uses: actions/checkout@v4
with:
fetch-depth: 0
- name: Install pnpm
uses: pnpm/action-setup@v4
- name: Use Node.js ${{ matrix.node-version }}
uses: actions/setup-node@v4
with:
node-version: ${{ matrix.node-version }}
cache: 'pnpm'
- name: Install dependencies
run: pnpm install
- name: Run build
run: pnpm build

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read}

Copilot Autofix

AI 3 days ago

To fix this problem, set an explicit permissions block restricting what the GitHub Actions jobs can do via the GITHUB_TOKEN. Since the workflow only runs linting and build steps (with no deployment, PR, or issue manipulation), the minimal required permission is contents: read. We should add the following at the top level, just below the workflow name, so it applies to all jobs. No change to functionality will result from this alteration.

  • File/region to change: .github/workflows/continuous-integration.yml, directly below the name: CI (after line 1).
  • What is needed:
    Add a permissions section:
    permissions:
      contents: read
    No further imports, method, or definition changes are needed.

Suggested changeset 1
.github/workflows/continuous-integration.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/continuous-integration.yml b/.github/workflows/continuous-integration.yml
--- a/.github/workflows/continuous-integration.yml
+++ b/.github/workflows/continuous-integration.yml
@@ -1,4 +1,6 @@
 name: CI
+permissions:
+  contents: read
 
 on: [push, pull_request]
 
EOF
@@ -1,4 +1,6 @@
name: CI
permissions:
contents: read

on: [push, pull_request]

Copilot is powered by AI and may make mistakes. Always verify output.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants