Skip to content

cachix test#3156

Draft
imalsogreg wants to merge 2 commits intocanaryfrom
greg/new-flake
Draft

cachix test#3156
imalsogreg wants to merge 2 commits intocanaryfrom
greg/new-flake

Conversation

@imalsogreg
Copy link
Contributor

@imalsogreg imalsogreg commented Feb 21, 2026

No description provided.

@vercel
Copy link

vercel bot commented Feb 21, 2026 •
edited
Loading

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
beps Ready Ready Preview, Comment Feb 22, 2026 7:33am
promptfiddle Ready Ready Preview, Comment Feb 22, 2026 7:33am

Request Review

@coderabbitai
Copy link
Contributor

coderabbitai bot commented Feb 21, 2026

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Post copyable unit tests in a comment
  • Commit unit tests in branch greg/new-flake

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

github-advanced-security[bot]
github-advanced-security bot found potential problems Feb 21, 2026
View reviewed changes
.github/workflows/nix-build.yaml
Comment on lines +14 to +33
runs-on: ubuntu-22.04
steps:
- uses: actions/checkout@v4

- uses: cachix/install-nix-action@v27
with:
nix_path: nixpkgs=channel:nixos-unstable

- uses: cachix/cachix-action@v15
with:
name: boundaryml
authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'

- name: Build CLI
run: nix build .#baml-cli -L

- name: Build WASM
run: nix build .#baml-schema-wasm -L

nix-build-macos:

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read}

Copilot Autofix

AI 29 days ago

In general, the fix is to explicitly define a permissions block for the workflow or individual jobs, granting only the minimal scopes required. In this workflow, the jobs just check out the repository and run Nix builds; they do not modify repository state or interact with issues/PRs, so contents: read at the workflow level is sufficient and is the recommended minimal starting point suggested by the warning.

The best fix with minimal functional impact is to add a top-level permissions block after the on: section (before concurrency: or jobs:). This will apply to both nix-build-linux and nix-build-macos jobs, and it sets GITHUB_TOKEN to read-only for repository contents. No additional imports or steps are needed; this is purely a YAML configuration change confined to .github/workflows/nix-build.yaml lines near the top of the file.

Suggested changeset 1
.github/workflows/nix-build.yaml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/nix-build.yaml b/.github/workflows/nix-build.yaml
--- a/.github/workflows/nix-build.yaml
+++ b/.github/workflows/nix-build.yaml
@@ -5,6 +5,9 @@
     branches: [canary, greg/new-flake]
   pull_request:
 
+permissions:
+  contents: read
+
 concurrency:
   group: nix-${{ github.ref }}
   cancel-in-progress: true
EOF
@@ -5,6 +5,9 @@
branches: [canary, greg/new-flake]
pull_request:

permissions:
contents: read

concurrency:
group: nix-${{ github.ref }}
cancel-in-progress: true
Copilot is powered by AI and may make mistakes. Always verify output.
.github/workflows/nix-build.yaml
steps:
- uses: actions/checkout@v4

- uses: cachix/install-nix-action@v27

Check warning

Code scanning / CodeQL

Unpinned tag for a non-immutable Action in workflow Medium

Unpinned 3rd party Action 'Nix Build (experimental)' step
Uses Step
Loading
uses 'cachix/install-nix-action' with ref 'v27', not a pinned commit hash
.github/workflows/nix-build.yaml
with:
nix_path: nixpkgs=channel:nixos-unstable

- uses: cachix/cachix-action@v15

Check warning

Code scanning / CodeQL

Unpinned tag for a non-immutable Action in workflow Medium

Unpinned 3rd party Action 'Nix Build (experimental)' step
Uses Step
Loading
uses 'cachix/cachix-action' with ref 'v15', not a pinned commit hash
.github/workflows/nix-build.yaml
Comment on lines +34 to +51
runs-on: macos-14
steps:
- uses: actions/checkout@v4

- uses: cachix/install-nix-action@v27
with:
nix_path: nixpkgs=channel:nixos-unstable

- uses: cachix/cachix-action@v15
with:
name: boundaryml
authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'

- name: Build CLI
run: nix build .#baml-cli -L

- name: Build WASM
run: nix build .#baml-schema-wasm -L

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read}

Copilot Autofix

AI 29 days ago

In general, the fix is to add an explicit permissions block to the workflow (at the top level so it applies to all jobs) specifying the least privilege needed. This workflow only checks out code and builds artifacts; it does not need to write to the repository or modify issues/PRs. The minimal safe set that matches CodeQL’s recommendation is contents: read. We add this under the root of the workflow, alongside on: and concurrency:, so that both nix-build-linux and nix-build-macos inherit these permissions without further changes. No additional imports or external dependencies are needed.

Concretely, in .github/workflows/nix-build.yaml, insert:

permissions:
  contents: read

after the on: block (or before concurrency:). This keeps existing functionality unchanged while constraining the GITHUB_TOKEN.

Suggested changeset 1
.github/workflows/nix-build.yaml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/nix-build.yaml b/.github/workflows/nix-build.yaml
--- a/.github/workflows/nix-build.yaml
+++ b/.github/workflows/nix-build.yaml
@@ -5,6 +5,9 @@
     branches: [canary, greg/new-flake]
   pull_request:
 
+permissions:
+  contents: read
+
 concurrency:
   group: nix-${{ github.ref }}
   cancel-in-progress: true
EOF
@@ -5,6 +5,9 @@
branches: [canary, greg/new-flake]
pull_request:

permissions:
contents: read

concurrency:
group: nix-${{ github.ref }}
cancel-in-progress: true
Copilot is powered by AI and may make mistakes. Always verify output.
.github/workflows/nix-build.yaml
steps:
- uses: actions/checkout@v4

- uses: cachix/install-nix-action@v27

Check warning

Code scanning / CodeQL

Unpinned tag for a non-immutable Action in workflow Medium

Unpinned 3rd party Action 'Nix Build (experimental)' step
Uses Step
Loading
uses 'cachix/install-nix-action' with ref 'v27', not a pinned commit hash
.github/workflows/nix-build.yaml
with:
nix_path: nixpkgs=channel:nixos-unstable

- uses: cachix/cachix-action@v15

Check warning

Code scanning / CodeQL

Unpinned tag for a non-immutable Action in workflow Medium

Unpinned 3rd party Action 'Nix Build (experimental)' step
Uses Step
Loading
uses 'cachix/cachix-action' with ref 'v15', not a pinned commit hash
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@imalsogreg