fix(ci): add least-privilege permissions to the openapi workflow job

[adityathebe]

Description

Fixes CodeQL code scanning alert #98 (Medium) — .github/workflows/gavel.yml:83, "Workflow does not contain permissions".

The openapi job had no permissions block and therefore inherited the broad default GITHUB_TOKEN scope. This adds an explicit least-privilege block:

  openapi:
    name: OpenAPI Integration
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:

matching the pattern already used by the test and lint jobs.

Scope note — the two High crypto alerts are intentionally not changed here

Alerts #92 and #93 flag SHA1/MD5 hashing in middleware/auth.go. That code exists to verify passwords against legacy htpasswd formats ({SHA}, $apr1$/$1$), and genuinely "fixing" the CodeQL finding would require removing SHA1/MD5 support — a breaking change to the middleware package's advertised multi-hash htpasswd support. We've decided to keep multi-hash support and instead dismiss #92/#93 in the Security tab as Won't fix (htpasswd compatibility). No changes to auth.go are included in this PR.

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update
• Performance improvement
• Code refactoring

Testing

• No code behavior changes — workflow-only change; the test/lint/openapi jobs run unchanged aside from the tightened token scope.

Checklist

• My code follows the style guidelines of this project
• I have performed a self-review of my own code
• My changes generate no new warnings

Breaking Changes

None. This PR only tightens the GITHUB_TOKEN permissions on one CI job.

Additional Notes

Alert details were supplied via a screenshot of the Security → Code scanning tab, since this session cannot reach GitHub's code-scanning API directly (the flanksource org hasn't connected the Claude GitHub App, and the GitHub MCP toolset here exposes no code-scanning endpoints). For the same reason, #92/#93 need to be dismissed manually in the Security tab.

🤖 Generated with Claude Code

https://claude.ai/code/session_01RiL4boF4wcNwKdvSRinVEf

[coderabbitai]

Warning

Review limit reached

@adityathebe, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 29 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 518e372e-b67d-4fa5-a3ce-69524a2bc68e

📥 Commits

Reviewing files that changed from the base of the PR and between 51970a4 and b25e62b.

📒 Files selected for processing (2)

• .github/workflows/gavel.yml
• examples/enitity/go.mod

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/codeql-security-reports-guj6zl

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch claude/codeql-security-reports-guj6zl

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Gavel summary

Source	Pass	Fail	Skip	Duration
ai	9	0	0	601.977µs
api	127	0	12	24ms
cache	25	0	0	103ms
clicky	98	0	0	6.3s
entity	34	0	0	2ms
exec	93	0	1	8.8s
flags	22	0	0	1ms
formatters	26	0	0	3ms
github.com/flanksource/clicky	28	0	0	13.5s
github.com/flanksource/clicky/ai	10	0	0	40ms
github.com/flanksource/clicky/aichat	102	0	0	-
github.com/flanksource/clicky/api	242	0	0	320ms
github.com/flanksource/clicky/api/tailwind	427	0	0	20ms
github.com/flanksource/clicky/cmd/clicky	10	0	0	-
github.com/flanksource/clicky/docs	19	0	0	-
github.com/flanksource/clicky/entity	46	0	0	-
github.com/flanksource/clicky/examples/enitity	7	0	0	-
github.com/flanksource/clicky/exec	3	0	0	340ms
github.com/flanksource/clicky/flags	32	0	0	10ms
github.com/flanksource/clicky/formatters	65	0	1	-
github.com/flanksource/clicky/formatters/http	38	0	0	-
github.com/flanksource/clicky/formatters/pdf	0	0	1	-
github.com/flanksource/clicky/formatters/tests	201	0	2	20ms
github.com/flanksource/clicky/internal/gumchoose	2	0	0	-
github.com/flanksource/clicky/lint	9	0	0	-
github.com/flanksource/clicky/markdown	9	0	0	-
github.com/flanksource/clicky/mcp	35	0	0	50ms
github.com/flanksource/clicky/middleware	31	0	0	-
github.com/flanksource/clicky/prompt	14	0	0	-
github.com/flanksource/clicky/rpc	206	0	1	50ms
github.com/flanksource/clicky/rpc/http	8	0	0	10ms
github.com/flanksource/clicky/task	122	0	0	12.6s
lint	8	0	0	8.0s
metrics	7	0	0	1ms
middleware	38	0	0	1ms
task	6	0	0	39ms
tests	11	0	47	8ms
text	78	0	0	305ms
valkey	36	0	0	68ms

Totals: 2284 passed · 0 failed · 65 skipped · 50.7s

View full results

[flankbot]

🎉 This PR is included in version 1.21.40