Token Permissions¶

This is an exhaustive list of required permissions organized by features.

Important

The GITHUB_TOKEN environment variable should be supplied when running on a private repository. Otherwise the runner does not not have the privileges needed for the features mentioned here.

File Changes¶

When using --files-changed-only or --lines-changed-only to get the list of file changes for a CI event, the following permissions are needed:

Push¶

For push events.

    permissions:
        contents: read

The contents permission is also needed to download files if the repository is not checked out before running cpp-linter.

Pull Request¶

For pull_request events.

    permissions:
        contents: read
        pull-requests: read

For pull requests, the contents permission is only needed to download files if the repository is not checked out before running cpp-linter.

Specifying write to the pull-requests permission is also sufficient as that is required for
posting thread comments on pull requests
posting pull request reviews

Thread Comments¶

The --thread-comments feature requires the following permissions:

Push¶

For push events.

    permissions:
      metadata: read
      contents: write

The metadata permission is needed to fetch existing comments.
The contents permission is needed to post or update a commit comment. This also allows us to delete an outdated comment if needed.

Pull Request¶

For pull_request events.

    permissions:
      pull-requests: write

Pull Request Reviews¶

The tidy-review, format-review, and passive-reviews features require the following permissions:

    permissions:
      pull-requests: write