adam/meal-order-manager
1
0
Fork 0
mirror of https://github.com/Sea-Haven-Industries/meal-order-manager.git synced 2026-09-30 06:33:12 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

chore: resolve open code scanning alerts (#58)
Some checks failed
Deploy / deploy (push) Has been cancelled
Details

Browse source 
* ci: add least-privilege permissions blocks to workflow callers
Resolves code scanning alerts #9 and #11 (actions/missing-workflow-permissions). Both callable workflows only need contents: read; the dependency-review callable already declares it internally, this caps the caller token to match.

* fix: turn off debug mode in Flask app configuration.

Resolves code scanning alert #2 (Flask app is run in debug mode)

* ci: bump reusable workflow pin to f71002a (ruff 0.15.22 pin)

Picks up Sea-Haven-Industries/.github#88, which pins ruff in
ci-python-sam so unpinned installs no longer float to new releases
with changed default rule sets (0.16.0 broke CI with 89 pre-existing
findings). Refs Sea-Haven-Industries/.github#87.
This commit is contained in:
Adam Moussa 2026-07-23 16:00:47 -04:00 • committed by GitHub
parent 4079d57757
commit 09052fa91a
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 11 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
.github/workflows/ci.yml vendored
View file

@ -4,8 +4,11 @@ on:
pull_request: pull_request:
branches: [main] branches: [main]
permissions:
contents: read
jobs: jobs:
ci: ci:
uses: Sea-Haven-Industries/.github/.github/workflows/ci-python-sam.yaml@fd60e4c9041784f666ac0fdefb9bec3c7fbf5143 # main uses: Sea-Haven-Industries/.github/.github/workflows/ci-python-sam.yaml@f71002a9ed2938730b683249b28059c92a081af6 # main
with: with:
run-tests: true run-tests: true

7
.github/workflows/dependency-review.yml vendored
View file

@ -1,6 +1,11 @@
name: Dependency Review name: Dependency Review
on: on:
pull_request: pull_request:
permissions:
contents: read
jobs: jobs:
review: review:
uses: Sea-Haven-Industries/.github/.github/workflows/callable-dependency-review.yaml@fd60e4c9041784f666ac0fdefb9bec3c7fbf5143 # main uses: Sea-Haven-Industries/.github/.github/workflows/callable-dependency-review.yaml@f71002a9ed2938730b683249b28059c92a081af6 # main

2
src/server/app.py
View file

@ -374,4 +374,4 @@ if __name__ == "__main__":
ORDERS_DIR.mkdir(exist_ok=True) ORDERS_DIR.mkdir(exist_ok=True)
print(f"Menu file: {latest_menu_file()}") print(f"Menu file: {latest_menu_file()}")
print(f"Orders dir: {ORDERS_DIR}") print(f"Orders dir: {ORDERS_DIR}")
app.run(host="0.0.0.0", port=5050, debug=True) app.run(host="0.0.0.0", port=5050, debug=False)