Adjust permissions of `update-doc-db` job by ShaharNaveh · Pull Request #7496 · RustPython/RustPython

ShaharNaveh

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yml

Review profile: CHILL

Plan: Pro

Run ID: 57faf312-0638-4167-aa93-abffc4c9f391

📥 Commits

Reviewing files that changed from the base of the PR and between 2f32112 and 311a7bd.

📒 Files selected for processing (1)

.github/workflows/update-doc-db.yml

🚧 Files skipped from review as they are similar to previous changes (1)

.github/workflows/update-doc-db.yml

📝 Walkthrough

Walkthrough

Top-level workflow permissions were cleared; job-level permissions were added. The generate job requests contents: read. The merge job requests contents: write and pull-requests: write. The explicit checkout token: ${{ secrets.AUTO_COMMIT_PAT }} was removed and the commit step now uses GH_TOKEN: ${{ github.token }}. One step’s run line was reordered relative to its env block without functional change.

Changes

Cohort / File(s)	Summary
GitHub Actions workflow `\.github/workflows/update-doc-db.yml`	Cleared global workflow permissions; added job-scoped permissions (`generate`: `contents: read`; `merge`: `contents: write`, `pull-requests: write`). Removed explicit `token: ${{ secrets.AUTO_COMMIT_PAT }}` from checkout; switched commit/push auth from `secrets.AUTO_COMMIT_PAT` to `${{ github.token }}`. Minor step reordering (env vs run) with no behavior change.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Poem

🐰 I nibbled at the workflow vine,
Trimmed permissions, tidy line by line.
Swapped the secret for a token known,
Reordered steps, no change was sown.
Hop, secure, and feeling fine. 🥕

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately and concisely describes the main change: adjusting permissions in the update-doc-db workflow job.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}