run java tests on safari #16754
Draft
run java tests on safari #16754
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Contributor
CI Feedback 🧐A test triggered by this PR failed. Here is an AI-generated analysis of the failure:
|
titusfortner
force-pushed
the
java_safari
branch
from
19e1569 to
23601a7
Compare
Comment on lines
+78
to
+89
| name: Safari Tests | ||
| uses: ./.github/workflows/bazel.yml | ||
| with: | ||
| name: Safari Tests | ||
| os: macos | ||
| cache-key: java-safari-tests | ||
| java-version: 17 | ||
| run: > | ||
| bazel test | ||
| --flaky_test_attempts 3 | ||
| --test_tag_filters=safari | ||
| //java/test/... |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 4 days ago
Generally, to fix this kind of issue you explicitly define a permissions: block either at the top level of the workflow (applying to all jobs that don’t override it) or inside each job. For test-only workflows that just need to check out code and run Bazel, the minimal safe choice is typically permissions: contents: read, which allows reading the repository contents while preventing unintended write operations with the GITHUB_TOKEN.
For this specific workflow, the simplest, non‑intrusive fix is to add a single root‑level permissions: block, just after the on: section and before jobs:. This will apply to all jobs (browser-tests-windows, browser-tests-macos, remote-tests, and safari-tests) and address the CodeQL warning at line 78, since that warning is about the absence of any explicit permissions for the job. There is no evidence in the snippet that any job needs write access (no step uses the token to modify issues, PRs, etc.), so setting contents: read is appropriate and should not break existing functionality.
Concretely:
-
Edit
.github/workflows/ci-java.yml. -
Insert:
permissions: contents: read
on its own indentation level after the
on:block (after line 5 and a blank line), shifting the existingjobs:definition down. No imports or other definitions are required.
Suggested changeset
1
.github/workflows/ci-java.yml
| @@ -4,6 +4,9 @@ | ||
| workflow_call: | ||
| workflow_dispatch: | ||
|
|
||
| permissions: | ||
| contents: read | ||
|
|
||
| jobs: | ||
| browser-tests-windows: | ||
| name: Browser Tests |
Copilot is powered by AI and may make mistakes. Always verify output.
titusfortner
force-pushed
the
java_safari
branch
from
23601a7 to
2399859
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Should figure out what is and isn't supported with Safari in Java.
Lots to debug, so this is in draft.