feat: first version #1

christiangda · 2026-01-18T12:37:42Z

No description provided.

github-advanced-security · 2026-01-18T12:44:46Z

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

.github/workflows/main.yml

+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: ./go.mod
+
+      - name: Summary Information
+        run: |
+          echo "# Push Summary" > $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "**Repository:** ${{ github.repository }}" >> $GITHUB_STEP_SUMMARY
+          echo "**Push:** ${{ github.event.head_commit.message }}" >> $GITHUB_STEP_SUMMARY
+          echo "**Author:** ${{ github.event.head_commit.author.name }}" >> $GITHUB_STEP_SUMMARY
+          echo "**Branch:** ${{ github.ref }}" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+
+      - name: Tools and versions
+        run: |
+          echo "## Tools and versions" >> $GITHUB_STEP_SUMMARY
+
+          ubuntu_version=$(lsb_release -a 2>&1 | grep "Description" | awk '{print $2, $3, $4}')
+          echo "Ubuntu version: $ubuntu_version"
+          echo "**Ubuntu Version:** $ubuntu_version" >> $GITHUB_STEP_SUMMARY
+
+          bash_version=$(bash --version | head -n 1 | awk '{print $4}')
+          echo "Bash version: $bash_version"
+          echo "**Bash Version:** $bash_version" >> $GITHUB_STEP_SUMMARY
+
+          git_version=$(git --version | awk '{print $3}')
+          echo "Git version: $git_version"
+          echo "**Git Version:** $git_version" >> $GITHUB_STEP_SUMMARY
+
+          go_version=$(go version | awk '{print $3}')
+          echo "Go version: $go_version"
+          echo "**Go Version:** $go_version" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+
+      - name: Lines of code
+        run: |
+          echo "## Lines of code" >> $GITHUB_STEP_SUMMARY
+
+          go install github.com/boyter/scc/v3@latest
+          scc --format html-table . | tee -a $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+
+      - name: test
+        run: |
+          echo "### Test report" >> $GITHUB_STEP_SUMMARY
+
+          go test -race -coverprofile=coverage.txt -covermode=atomic -tags=unit ./... | tee -a $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+
+      - name: test coverage
+        run: |
+          echo "## Test Coverage" >> $GITHUB_STEP_SUMMARY
+
+          go install github.com/vladopajic/go-test-coverage/v2@latest
+
+          # execute again to get the summary
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "### Coverage report" >> $GITHUB_STEP_SUMMARY
+          go-test-coverage --config=./.testcoverage.yml | sed 's/PASS/PASS  ✅/g' | sed 's/FAIL/FAIL  ❌/g' | tee -a $GITHUB_STEP_SUMMARY
+
+      - name: Build
+        run: |
+          echo "## Build" >> $GITHUB_STEP_SUMMARY
+
+          go build ./... | tee -a $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "Build completed successfully." >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY


To fix the problem, explicitly declare minimal GITHUB_TOKEN permissions in the workflow so the job does not inherit overly broad defaults. Since this workflow only needs to read repository contents and releases and write to the job summary (which does not require any special token permission), we can safely set contents: read at the workflow level.

The best fix is to add a permissions block near the top of .github/workflows/main.yml, alongside name and on, so it applies to all jobs. Concretely, insert:

permissions: contents: read

between the name: Main and on: lines. No changes are needed to any steps, environment variables, or uses of github.token. This restricts the GITHUB_TOKEN to read-only access to repository contents while preserving all existing functionality (checkout, viewing and downloading releases, and generating summaries).

.github/workflows/pr.yml

+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: ./go.mod
+
+      - name: Summary Information
+        run: |
+          echo "# Pull Request Summary" > $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "**Repository:** ${{ github.repository }}" >> $GITHUB_STEP_SUMMARY
+          echo "**Pull Request:** ${{ github.event.pull_request.title }}" >> $GITHUB_STEP_SUMMARY
+          echo "**Author:** ${{ github.event.pull_request.user.login }}" >> $GITHUB_STEP_SUMMARY
+          echo "**Branch:** ${{ github.event.pull_request.head.ref }}" >> $GITHUB_STEP_SUMMARY
+          echo "**Base:** ${{ github.event.pull_request.base.ref }}" >> $GITHUB_STEP_SUMMARY
+          echo "**Commits:** ${{ github.event.pull_request.commits }}" >> $GITHUB_STEP_SUMMARY
+          echo "**Changed Files:** ${{ github.event.pull_request.changed_files }}" >> $GITHUB_STEP_SUMMARY
+          echo "**Additions:** ${{ github.event.pull_request.additions }}" >> $GITHUB_STEP_SUMMARY
+          echo "**Deletions:** ${{ github.event.pull_request.deletions }}" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+
+      - name: Tools and versions
+        run: |
+          echo "## Tools and versions" >> $GITHUB_STEP_SUMMARY
+
+          ubuntu_version=$(lsb_release -a 2>&1 | grep "Description" | awk '{print $2, $3, $4}')
+          echo "Ubuntu version: $ubuntu_version"
+          echo "**Ubuntu Version:** $ubuntu_version" >> $GITHUB_STEP_SUMMARY
+
+          bash_version=$(bash --version | head -n 1 | awk '{print $4}')
+          echo "Bash version: $bash_version"
+          echo "**Bash Version:** $bash_version" >> $GITHUB_STEP_SUMMARY
+
+          git_version=$(git --version | awk '{print $3}')
+          echo "Git version: $git_version"
+          echo "**Git Version:** $git_version" >> $GITHUB_STEP_SUMMARY
+
+          go_version=$(go version | awk '{print $3}')
+          echo "Go version: $go_version"
+          echo "**Go Version:** $go_version" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+
+      - name: Lines of code
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          export TOOL_NAME="scc"
+          export GIT_ORG="boyter"
+          export GIT_REPO="scc"
+          export OS=$(uname -s)
+          export OS_ARCH=$(uname -m)
+          # Normalize architecture names to match asset naming
+          [[ "$OS_ARCH" == "aarch64" ]] && OS_ARCH="arm64"
+          [[ "$OS_ARCH" == "x86_64" ]] && OS_ARCH="x86_64"
+          export ASSETS_NAME=$(gh release view --repo ${GIT_ORG}/${GIT_REPO} --json assets -q "[.assets[] | select(.name | contains(\"${TOOL_NAME}\") and contains(\"${OS}\") and contains(\"${OS_ARCH}\"))] | sort_by(.createdAt) | last.name")
+
+          gh release download --repo $GIT_ORG/$GIT_REPO --pattern $ASSETS_NAME
+
+          # Extract based on file extension
+          if [[ "$ASSETS_NAME" == *.tar.gz ]]; then
+            tar -xzf $ASSETS_NAME
+          elif [[ "$ASSETS_NAME" == *.zip ]]; then
+            unzip $ASSETS_NAME
+          fi
+
+          rm $ASSETS_NAME
+
+          mv $TOOL_NAME ~/go/bin/$TOOL_NAME
+          ~/go/bin/$TOOL_NAME --version
+
+          # go install github.com/boyter/scc/v3@latest
+
+          scc --format html-table . | tee -a $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+
+      - name: test
+        run: |
+          echo "### Test report" >> $GITHUB_STEP_SUMMARY
+
+          go test -race -coverprofile=coverage.txt -covermode=atomic -tags=unit ./... | tee -a $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+
+      - name: test coverage
+        run: |
+          echo "## Test Coverage" >> $GITHUB_STEP_SUMMARY
+
+          # Generate coverage report using standard library tools
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "### Coverage report" >> $GITHUB_STEP_SUMMARY
+          echo '```' >> $GITHUB_STEP_SUMMARY
+          go tool cover -func=coverage.txt | tee -a $GITHUB_STEP_SUMMARY
+          echo '```' >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+
+          # Calculate total coverage percentage
+          total_coverage=$(go tool cover -func=coverage.txt | grep total | awk '{print $3}')
+          echo "**Total Coverage:** $total_coverage" >> $GITHUB_STEP_SUMMARY


In general, the fix is to add an explicit permissions block to the workflow (or to the specific job) that grants only the minimal rights needed. This avoids inheriting potentially broad repository defaults for the GITHUB_TOKEN.

For this workflow, all operations are read-only: checking out code, running Go tests, generating coverage, and using gh to read release assets from a public repository. No step needs write access to repository contents, pull requests, or issues. Therefore, the best fix is to add a workflow-level permissions block setting contents: read, which will apply to all jobs that don’t override it. This matches CodeQL’s suggested minimal configuration and does not change existing behavior in a typical setup, because reading repository contents is still allowed while write permissions are removed.

Concretely, edit .github/workflows/pr.yml to insert:

permissions: contents: read

right after the name: Pull Request header (before on:). No additional imports or methods are needed, and no steps need modification, because all existing uses of GITHUB_TOKEN remain compatible with a read-only contents permission.

feat: first version

6a2f3c2

christiangda self-assigned this Jan 18, 2026

fix: github workflows and files

d89ff86

github-advanced-security bot found potential problems Jan 18, 2026

View reviewed changes

christiangda added 6 commits January 18, 2026 13:47

feat: update the go version

cf733e7

fix: install scc tools from binary

baa5bfb

fix: install scc tools from binary

b3ca029

fix: install scc tools from binary

c430513

fix: install scc tools from binary

88b42f3

fix: install scc tools from binary

a47d1cf

github-advanced-security bot found potential problems Jan 18, 2026

View reviewed changes

fix: workflows steps name

7a01913

christiangda merged commit 40a0a49 into main Jan 18, 2026
4 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat: first version #1

feat: first version #1

Uh oh!

christiangda commented Jan 18, 2026

Uh oh!

github-advanced-security bot commented Jan 18, 2026

Uh oh!

Check warning

Copilot Autofix

Uh oh!

Check warning

Copilot Autofix

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

@@ -1,5 +1,8 @@
             name: Main
+            permissions:
+              contents: read
             on:
               push:
                 branches:

Uh oh!

feat: first version #1

feat: first version #1

Uh oh!

Conversation

christiangda commented Jan 18, 2026

Uh oh!

github-advanced-security bot commented Jan 18, 2026

Uh oh!

Check warning

Copilot Autofix

Uh oh!

Check warning

Copilot Autofix

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants