Updating Offline Mode #505

renatodellosso · 2025-04-13T18:34:29Z

No description provided.

Signin method warning

Shuffles scouters.

…o e2e-testing

…in tests

Bumps [jose](https://github.com/panva/jose) from 6.0.8 to 6.0.10. - [Release notes](https://github.com/panva/jose/releases) - [Changelog](https://github.com/panva/jose/blob/main/CHANGELOG.md) - [Commits](panva/jose@v6.0.8...v6.0.10) --- updated-dependencies: - dependency-name: jose dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [react-icons](https://github.com/react-icons/react-icons) from 5.4.0 to 5.5.0. - [Release notes](https://github.com/react-icons/react-icons/releases) - [Commits](react-icons/react-icons@v5.4.0...v5.5.0) --- updated-dependencies: - dependency-name: react-icons dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

…/npm_and_yarn-9eaa48ee01 [npm]: Bump next from 15.2.3 to 15.2.4 in the npm_and_yarn group

…Avatar editing

Bumps [@eslint/js](https://github.com/eslint/eslint/tree/HEAD/packages/js) from 9.18.0 to 9.24.0. - [Release notes](https://github.com/eslint/eslint/releases) - [Changelog](https://github.com/eslint/eslint/blob/main/CHANGELOG.md) - [Commits](https://github.com/eslint/eslint/commits/v9.24.0/packages/js) --- updated-dependencies: - dependency-name: "@eslint/js" dependency-version: 9.24.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [resend](https://github.com/resendlabs/resend-node) from 4.1.2 to 4.2.0. - [Release notes](https://github.com/resendlabs/resend-node/releases) - [Commits](resend/resend-node@v4.1.2...v4.2.0) --- updated-dependencies: - dependency-name: resend dependency-version: 4.2.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next) from 15.2.2 to 15.2.4. - [Release notes](https://github.com/vercel/next.js/releases) - [Changelog](https://github.com/vercel/next.js/blob/canary/release.js) - [Commits](https://github.com/vercel/next.js/commits/v15.2.4/packages/eslint-config-next) --- updated-dependencies: - dependency-name: eslint-config-next dependency-version: 15.2.4 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [@serwist/next](https://github.com/serwist/serwist) from 9.0.11 to 9.0.13. - [Release notes](https://github.com/serwist/serwist/releases) - [Commits](https://github.com/serwist/serwist/compare/@serwist/next@9.0.11...@serwist/next@9.0.13) --- updated-dependencies: - dependency-name: "@serwist/next" dependency-version: 9.0.13 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>

…/eslint/js-9.24.0 [npm]: Bump @eslint/js from 9.18.0 to 9.24.0

…/resend-4.2.0 [npm]: Bump resend from 4.1.2 to 4.2.0

…/eslint-config-next-15.2.4 [npm]: Bump eslint-config-next from 15.2.2 to 15.2.4

…/serwist/next-9.0.13 [npm]: Bump @serwist/next from 9.0.11 to 9.0.13

.github/workflows/e2e_test.yml

+    timeout-minutes: 60
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        # Make sure to require each shard in GitHub!
+        shardIndex: [1, 2, 3, 4]
+        shardTotal: [4]
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: lts/*
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Install Playwright browsers
+        run: npx playwright install --with-deps
+
+      - name: Start MongoDB
+        uses: supercharge/mongodb-github-action@1.12.0
+        with:
+          mongodb-version: "8.0"
+
+      - name: Run Playwright tests
+        run: npx cross-env NODE_ENV=test playwright test --shard=${{ matrix.shardIndex }}/${{ matrix.shardTotal }}
+
+      - name: Upload blob report to GitHub Actions Artifacts
+        if: ${{ !cancelled() }}
+        uses: actions/upload-artifact@v4
+        with:
+          name: blob-report-${{ matrix.shardIndex }}
+          path: blob-report
+          retention-days: 1
+
+  merge_reports:


In general, this issue is fixed by explicitly setting the permissions for the GITHUB_TOKEN at the workflow or job level, instead of relying on organization/repository defaults. For test workflows like this one, contents: read is typically sufficient, as the workflow only checks out code and uses artifacts, and does not need to write to the repository, issues, or pull requests.

The best fix here, without changing existing functionality, is to add a permissions block at the top level of .github/workflows/e2e_test.yml, just below name: (or immediately after on:). This root-level permissions configuration will apply to all jobs (e2e_tests and merge_reports) since neither defines its own permissions. The minimal safe starting point per CodeQL’s suggestion is contents: read, which allows actions/checkout@v4 to function while avoiding unnecessary write access. No additional imports or methods are needed; only the YAML configuration is updated.

Concretely: in .github/workflows/e2e_test.yml, insert:

permissions: contents: read

near the top of the file (e.g., after line 2), keeping indentation aligned with name: and on: keys.

.github/workflows/e2e_test.yml

+    if: ${{ !cancelled() }}
+    needs: [e2e_tests]
+
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: lts/*
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Download blob reports from GitHub Actions Artifacts
+        uses: actions/download-artifact@v4
+        with:
+          path: all-blob-reports
+          pattern: blob-report-*
+          merge-multiple: true
+
+      - name: Merge into HTML Report
+        run: npx playwright merge-reports --reporter html ./all-blob-reports
+
+      - name: Upload HTML report
+        uses: actions/upload-artifact@v4
+        with:
+          name: html-report--attempt-${{ github.run_attempt }}
+          path: playwright-report
+          retention-days: 14


In general, the fix is to explicitly declare a permissions block in the workflow so that the GITHUB_TOKEN used by jobs has only the minimal scopes required. For this workflow, the jobs check out the code (actions/checkout) and interact with artifacts (actions/upload-artifact, actions/download-artifact). These operations only require contents: read plus the default access that Actions grants for artifacts; no repository write or administrative permissions are needed.

The best minimal fix without changing functionality is to add a top-level permissions block so it applies to all jobs (e2e_tests and merge_reports). This should be placed near the top of .github/workflows/e2e_test.yml, after the on: block, and set contents: read. No other permission scopes appear necessary from the provided snippet. No imports or additional methods are needed; we only modify the YAML workflow definition.

Specifically: edit .github/workflows/e2e_test.yml to insert:

permissions: contents: read

between the existing on: [workflow_dispatch, workflow_call] line and the jobs: line. This constrains the GITHUB_TOKEN for all jobs in this workflow while preserving existing behavior.

Copilot

Copilot reviewed 52 out of 55 changed files in this pull request and generated no comments.

Files not reviewed (3)

.env.production: Language not supported
.env.test: Language not supported
.vscode/extensions.json: Language not supported

BanEvading and others added 30 commits March 27, 2025 16:44

Added initial tag.

674e1c7

Updating wording and stying

184c577

Updating styling

578e404

Formatting

1d6a49f

1.2.25

67ea9b9

Shuffles scouters.

6d311e4

Merge pull request #491 from Decatur-Robotics/signin-method-warning

02447c3

Signin method warning

1.2.25

64f6a66

Fixes Formatting

43dffca

Merge pull request #492 from Decatur-Robotics/randomize-scouters

7bf66b9

Shuffles scouters.

Initted Playwright

5198097

Move old tests into tests/unit

f53844e

Config web server for playwright

a222904

Add tests for index page

7898a8f

1.2.26

766450d

Update Jest configuration and CI workflows for Playwright tests

c153ece

Merge branch 'e2e-testing' of github.com:Decatur-Robotics/Gearbox int…

aa1a0af

…o e2e-testing

Fix package.json formatting

1691b78

Don't error if ROLLBAR_TOKEN isn't set

1a34bce

Update environment configuration and CI workflows for Playwright tests

ae8a167

Set up sign in function for e2e tests

a761475

Use mongodb in e2e tests

b66169e

No more Resend errors when API key is missing

5aebd52

Fewer Rollbar errors, no request helper constructor logs

aa4cf8c

Add API key check in request method and safeguard user ID assignment …

a488833

…in tests

Fix error in allCompetitionsToPairings when TBA is disabled

e510aec

Add NextAuth vars to .env.test

bfadfff

1.2.26

8b3bd8b

renatodellosso and others added 26 commits April 3, 2025 13:28

Merge pull request #497 from Decatur-Robotics/dependabot/npm_and_yarn…

e17052e

…/npm_and_yarn-9eaa48ee01 [npm]: Bump next from 15.2.3 to 15.2.4 in the npm_and_yarn group

Add better API error logging

b086a3d

Even better API error logging

7e35f6d

Add avatar editing functionality

9808034

Ctrl + S

5526712

Add e2e test for avatar editing functionality

5aeba61

Ctrl + S & added Title attribute to card

e79b2e6

Add altText prop to Avatar component and add remaining e2e tests for …

e1660bb

…Avatar editing

getAttribute -> toHaveAttribute

cc3fa30

Level no longer displays above top bar

b1cfdb7

Ctrl + S

c062c78

Add ViewMatchesModal component and integrate it into CompHeaderCard

3cecea6

Add key prop to ViewMatchCard in ViewMatchesModal

83b438a

Add export schedule as CSV, style my matches modal

0baab92

1.3.2

a6ae069

1.3.2

58946df

1.3.2

fa719f0

1.3.2

6bbd1f8

Merge pull request #499 from Decatur-Robotics/dependabot/npm_and_yarn…

cd9677b

…/eslint/js-9.24.0 [npm]: Bump @eslint/js from 9.18.0 to 9.24.0

Merge pull request #500 from Decatur-Robotics/dependabot/npm_and_yarn…

e96aab5

…/resend-4.2.0 [npm]: Bump resend from 4.1.2 to 4.2.0

Merge pull request #501 from Decatur-Robotics/dependabot/npm_and_yarn…

9ae0c43

…/eslint-config-next-15.2.4 [npm]: Bump eslint-config-next from 15.2.2 to 15.2.4

Merge pull request #502 from Decatur-Robotics/dependabot/npm_and_yarn…

132d65b

…/serwist/next-9.0.13 [npm]: Bump @serwist/next from 9.0.11 to 9.0.13

github-advanced-security bot found potential problems Apr 13, 2025

View reviewed changes

renatodellosso requested a review from Copilot April 13, 2025 18:34

Copilot AI reviewed Apr 13, 2025

View reviewed changes

renatodellosso merged commit 452ad03 into offline-mode Apr 13, 2025
16 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Updating Offline Mode #505

Updating Offline Mode #505

Uh oh!

renatodellosso commented Apr 13, 2025

Uh oh!

Check warning

Copilot Autofix

Check warning

Copilot Autofix

Copilot AI left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

@@ -1,5 +1,7 @@
             name: Playwright Tests
             on: [workflow_dispatch, workflow_call]
+            permissions:
+              contents: read
             jobs:
               e2e_tests:
                 timeout-minutes: 60

Updating Offline Mode #505

Updating Offline Mode #505

Uh oh!

Conversation

renatodellosso commented Apr 13, 2025

Uh oh!

Check warning

Copilot Autofix

Check warning

Copilot Autofix

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants