Repository navigation
Add permissions block to example caller workflow to satisfy CodeQL #18
Description
Non-Blocking Review Concern: Add permissions block to example caller workflow to satisfy CodeQL
Source: github-advanced-security[bot]
Location: .github/workflows/claude-code-review.yml:36
PR: #17 — feat(blocking-review): add cost guards and scope constraints (#17)
Merged: 2026-03-20
What was flagged
CodeQL flagged that the workflow lacks a permissions block. However, looking at the diff, the new version of claude-code-review.yml actually does have a top-level permissions block (contents:read, pull-requests:write, issues:write, id-token:write) added at line 15. The CodeQL alert at line 36 likely refers to the old file state or a stale scan. Verify the CodeQL alert auto-closes after merge; if it persists, dismiss it as resolved.
Context
This issue was automatically created from a non-blocking concern identified
during pre-merge review of PR #17. It was safe to merge but worth tracking.
Created by pre-merge-review.sh
Activity
twistedmelonman commentedon Apr 18, 2026
Resolved in PR #41. The original example caller (
.github/workflows/claude-code-review.yml) was replaced with.github/workflows/self-review.yml, which declarespermissions:at the top level (contents: read, pull-requests: write, issues: write, id-token: write) — matching what the reusable workflow's permission-verification step requires.