Updates from the package template - #423
Merged
Merged
Conversation
github-actions
Bot
added
the
No Changelog Entry Needed
Contributor
Reviewer's GuideAligns the project with the latest SunPy package template by switching CI coverage reporting to Codecov OIDC, updating CI Python/tox targets, and moving zizmor security scanning from pre-commit to a dedicated GitHub Actions workflow. File-Level Changes
Assessment against linked issues
Possibly linked issues
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
nabobalis
marked this pull request as ready for review
August 17, 2026 16:47
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Hey - I've found 2 issues, and left some high level feedback:
- Now that Codecov uses OIDC, consider removing the unused CODECOV_TOKEN secret from the repository settings to avoid carrying obsolete credentials.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- Now that Codecov uses OIDC, consider removing the unused CODECOV_TOKEN secret from the repository settings to avoid carrying obsolete credentials.
## Individual Comments
### Comment 1
<location path=".github/workflows/ci.yml" line_range="35-36" />
<code_context>
jobs:
core:
uses: OpenAstronomy/github-actions-workflows/.github/workflows/tox.yml@8c8bb6c6c962542921f993d47d26df38dccd50b1 # v3.0.2
+ permissions:
+ id-token: write
with:
submodules: false
</code_context>
<issue_to_address>
**🚨 issue (security):** Consider also granting `contents: read` for jobs that rely on the reusable tox workflow.
Because the workflow sets `permissions: {}` at the top, this job is currently only granting `id-token: write`. If the reusable `tox.yml` workflow does a checkout (likely), it will also need `contents: read` from the calling job or steps may fail with permission errors. For jobs using the reusable `tox.yml` and Codecov OIDC upload, consider:
```yaml
actions:
permissions:
contents: read
id-token: write
```
</issue_to_address>
### Comment 2
<location path=".github/workflows/zizmor.yml" line_range="9" />
<code_context>
+ pull_request:
+ branches: ["**"]
+
+permissions: {}
+
+jobs:
</code_context>
<issue_to_address>
**🚨 issue (security):** Top-level `permissions: {}` combined with checkout likely requires adding `contents: read` at job or workflow level.
With workflow-level `permissions: {}`, this job only restores `security-events: write`, so `actions/checkout` lacks `contents: read` and may fail. Either:
- Add at workflow level:
```yaml
permissions:
contents: read
```
and keep `security-events: write` at the job level, or
- Define both at the job level:
```yaml
permissions:
contents: read
security-events: write
```
</issue_to_address>Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
Comment on lines
+35
to
+36
| permissions: | ||
| id-token: write |
Contributor
There was a problem hiding this comment.
🚨 issue (security): Consider also granting contents: read for jobs that rely on the reusable tox workflow.
Because the workflow sets permissions: {} at the top, this job is currently only granting id-token: write. If the reusable tox.yml workflow does a checkout (likely), it will also need contents: read from the calling job or steps may fail with permission errors. For jobs using the reusable tox.yml and Codecov OIDC upload, consider:
actions:
permissions:
contents: read
id-token: write| pull_request: | ||
| branches: ["**"] | ||
|
|
||
| permissions: {} |
Contributor
There was a problem hiding this comment.
🚨 issue (security): Top-level permissions: {} combined with checkout likely requires adding contents: read at job or workflow level.
With workflow-level permissions: {}, this job only restores security-events: write, so actions/checkout lacks contents: read and may fail. Either:
- Add at workflow level:
and keep
permissions: contents: read
security-events: writeat the job level, or - Define both at the job level:
permissions: contents: read security-events: write
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #422
This is an autogenerated PR, which will applies the latest changes from the SunPy Package Template.
If this pull request has been opened as a draft there are conflicts which need fixing.
To run the CI on this pull request you will need to close it and reopen it.
Summary by Sourcery
Update CI and pre-commit configuration to use OIDC-based Codecov reporting and move zizmor security checks into a dedicated GitHub Actions workflow.
CI:
Tests:
Chores:
Summary by Sourcery
Modernize CI security scanning and coverage reporting to align with the latest package template.
New Features:
Enhancements:
CI: