This guide provides best practices for using the Qwen Code GitHub Action, with a focus on repository security and operational excellence.
A secure repository is the foundation for any reliable and safe automation. We strongly recommend implementing the following security measures.
Protecting your branches and tags is critical to preventing unauthorized changes. You can use repository rulesets to configure protection for your branches and tags.
We recommend the following at a minimum for your main branch:
- Require a pull request before merging
- Require a minimum number of approvals
- Dismiss stale approvals
- Require status checks to pass before merging
For more information, see the GitHub documentation on managing branch protections.
To prevent fraudulent or accidental approvals, you can restrict who can approve pull requests.
- CODEOWNERS: Use a
CODEOWNERSfile to define individuals or teams that are responsible for code in your repository. - Code review limits: Limit code review approvals to specific users or teams.
Never hardcode secrets (e.g., API keys, tokens) in your workflows. Use GitHub Secrets to store sensitive information.
To ensure the stability and security of your workflows, pin the Qwen Code action to a specific version.
uses: QwenLM/qwen-code-action@v0When creating your own workflows, we recommend starting with the examples provided in this repository. These examples demonstrate how to use the qwen-code-action for various use cases, such as pull request reviews, issue triage, and more.
Ensure the new workflows you create follow the principle of least privilege. Only grant the permissions necessary to perform the required tasks.