From eeef2d7539e7323536424603592bd390f3587119 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Sat, 30 May 2026 03:17:52 +0000 Subject: [PATCH 1/4] fix(deps): update dependency ops to v3.7.1 --- pyproject.toml | 2 +- uv.lock | 8 ++++---- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/pyproject.toml b/pyproject.toml index 7dd2905..5b382b0 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -17,7 +17,7 @@ classifiers = [ ] dependencies = [ "cosl==1.9.1", - "ops==3.7.0", + "ops==3.7.1", "tabulate==0.10.0", ] diff --git a/uv.lock b/uv.lock index 3f9391f..60bda40 100644 --- a/uv.lock +++ b/uv.lock @@ -455,7 +455,7 @@ unit = [ [package.metadata] requires-dist = [ { name = "cosl", specifier = "==1.9.1" }, - { name = "ops", specifier = "==3.7.0" }, + { name = "ops", specifier = "==3.7.1" }, { name = "tabulate", specifier = "==0.10.0" }, ] @@ -1259,16 +1259,16 @@ wheels = [ [[package]] name = "ops" -version = "3.7.0" +version = "3.7.1" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "opentelemetry-api" }, { name = "pyyaml" }, { name = "websocket-client" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/7b/af/57895c8b7c23bf98e07d6306d24d2775a1e89fc2a4c8c1bd934dba3acdc2/ops-3.7.0.tar.gz", hash = "sha256:15f04b2fcf1d8bc966cd4405b68a2c71fa24c06f234d5003e89cc4f18ee51a45", size = 580141, upload-time = "2026-03-30T05:17:16.285Z" } +sdist = { url = "https://files.pythonhosted.org/packages/42/60/ad398d889fd03b1b4f950fad54ad4d0cf7a81fde21f9866a8139c8f03684/ops-3.7.1.tar.gz", hash = "sha256:1765bf6d1cff376ea27608542e183b055c89f2c5f54bca602072bcc817195abc", size = 582424, upload-time = "2026-05-28T04:13:43.906Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/35/b0/19722b4b51696fbca41d3454f3dd3a73e89951303487b47280c6f3e277d4/ops-3.7.0-py3-none-any.whl", hash = "sha256:7050d5e629ac17de9d443e64f4ad09857e8012c9012c8ba66c9e765899d50bd1", size = 211865, upload-time = "2026-03-30T05:17:11.644Z" }, + { url = "https://files.pythonhosted.org/packages/ca/20/742e720af65f9ad23ae0cfe140502a10b2e74da6c63773f3999dad793661/ops-3.7.1-py3-none-any.whl", hash = "sha256:559dc6770e551da5f4b9686a5605ed927c140182eb38bcc31c1c531c2f98923a", size = 212723, upload-time = "2026-05-28T04:13:39.845Z" }, ] [[package]] From 5e11222a0c65790a9253355719ca2e5ed493fb57 Mon Sep 17 00:00:00 2001 From: "Sebastien Georget (charmkeeper)" Date: Thu, 18 Jun 2026 22:44:47 +0200 Subject: [PATCH 2/4] Add pull-requests write permission to bot_pr_approval job The bot_pr_approval workflow requires 'pull-requests: write' permission to create PR reviews via the GitHub API. This permission is now explicitly declared at the job level as required by strict permission policies. --- .github/workflows/bot_pr_approval.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/bot_pr_approval.yaml b/.github/workflows/bot_pr_approval.yaml index e38c584..8cf0e8e 100644 --- a/.github/workflows/bot_pr_approval.yaml +++ b/.github/workflows/bot_pr_approval.yaml @@ -7,3 +7,5 @@ jobs: bot_pr_approval: uses: canonical/operator-workflows/.github/workflows/bot_pr_approval.yaml@main secrets: inherit + permissions: + pull-requests: write From 67b6c02a677e41f16ce4714e6c69050bcd030b86 Mon Sep 17 00:00:00 2001 From: "Sebastien Georget (charmkeeper)" Date: Fri, 19 Jun 2026 07:53:38 +0200 Subject: [PATCH 3/4] Add missing permissions to integration_test workflow jobs Add required permissions at the job level to enable proper GitHub Actions access: - integration-tests job: contents:read, packages:write, pull-requests:write (Required for checking out code, pushing images to ghcr.io, and posting Trivy warning comments) - allure-report job: contents:write (Required for pushing Allure reports to gh-pages branch) As per operator-workflows README: https://github.com/canonical/operator-workflows these permissions are required when the GitHub organisation has read-only token defaults. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .github/workflows/integration_test.yaml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.github/workflows/integration_test.yaml b/.github/workflows/integration_test.yaml index 8801212..e9bad56 100644 --- a/.github/workflows/integration_test.yaml +++ b/.github/workflows/integration_test.yaml @@ -7,6 +7,10 @@ on: jobs: integration-tests: + permissions: + contents: read + packages: write + pull-requests: write uses: canonical/operator-workflows/.github/workflows/integration_test.yaml@main secrets: inherit with: @@ -18,6 +22,8 @@ jobs: self-hosted-runner: true with-uv: true allure-report: + permissions: + contents: write if: ${{ !cancelled() && github.event_name == 'schedule' }} needs: - integration-tests From 2120ecb3faf2328114d821839d8e63b1f9d965dc Mon Sep 17 00:00:00 2001 From: "Sebastien Georget (charmkeeper)" Date: Fri, 19 Jun 2026 08:32:29 +0200 Subject: [PATCH 4/4] Add missing permissions to test workflow job Add 'contents: read' and 'pull-requests: write' permissions at the job level to the unit-tests job as required by the canonical/operator-workflows test.yaml workflow. These permissions enable repository checkout and allow the workflow to post PR comments about charm library updates. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .github/workflows/test.yaml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml index 6446a3c..46f001c 100644 --- a/.github/workflows/test.yaml +++ b/.github/workflows/test.yaml @@ -6,6 +6,9 @@ on: jobs: unit-tests: uses: canonical/operator-workflows/.github/workflows/test.yaml@main + permissions: + contents: read + pull-requests: write secrets: inherit with: with-uv: true