Feature/922 make permissions configurable for custom workflows by ArBridgeman · Pull Request #923 · exasol/python-toolbox

ArBridgeman · 2026-07-09T11:58:44Z

closes #922

Checklist

Note: If any of the items in the checklist are not relevant to your PR, just check the box.

For any Pull Request

Is the following correct:

the title of the Pull Request?
the title of the corresponding issue?
there are no other open Pull Requests for the same update/change?
that the issue which this Pull Request fixes ("Fixes...") is mentioned?

When Changes Were Made

Did you:

update the changelog?
update the cookiecutter-template?
update the implementation?
check coverage and add tests: unit tests and, if relevant, integration tests?
update the User Guide & other documentation?
resolve any failing CI criteria (incl. Sonar quality gate)?

When Preparing a Release

Have you:

thought about version number (major, minor, patch)?
checked Exasol packages for updates and resolved open vulnerabilities, if easily possible?

…flows

… be handled separately

…in ALL anymore

- This is already present in the CLI of the nox sessions workflow:check and workflow:generate - This is already required by the WorkflowOrchestrator which is a pydantic model which restricts WorkflowChoice and hard-code maps it to the right values.

ArBridgeman · 2026-07-10T09:14:22Z

        Render the selected workflows and write them to disk.
        """
-        for workflow in self._iter_workflows():
+        # First, generate not-maintained workflows for a new project.


This was actually an unidentified bug in the setup. So when we just had secrets, it went unnoticed as the default slow-checks.yml doesn't have secrets that need to be passed. However, as permissions should always be set to adhere to the best security practices; it's best that we separate the two workflow types PTB-controlled vs custom at a higher level.

ArBridgeman · 2026-07-10T09:49:51Z

@codex

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 69e8d1492a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

…r_custom_workflows

sonarqubecloud · 2026-07-10T13:41:59Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
98.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

kratz00 · 2026-07-13T07:06:10Z


+## Feature
+
+* #922:  Extended `custom_workflows` of `github_template_dict` for automatic custom workflow permissions extraction


Suggested change

* #922: Extended `custom_workflows` of `github_template_dict` for automatic custom workflow permissions extraction

* #922: Extended `custom_workflows` of `github_template_dict` for automatic custom workflow permissions extraction

kratz00 · 2026-07-13T07:29:19Z

+    WRITE = 2
+
+    @classmethod
+    def _missing_(cls, value: object) -> PermissionRank:


I get an error, that PermissionRank is unknown!?

Suggested change

def _missing_(cls, value: object) -> PermissionRank:

def _missing_(cls, value: object) -> Self:

ckunki · 2026-07-13T07:05:25Z

 * #875: Added `name` attribute to generated workflow jobs using `-extension.yml` workflows

-## Bug
+## Bug Fix


See https://github.com/exasol/python-toolbox/blob/main/exasol/toolbox/util/release/changelog.py#L34

Suggested change

## Bug Fix

## Bugfixes

ckunki · 2026-07-13T07:06:04Z


 ## Summary

+## Feature


See https://github.com/exasol/python-toolbox/blob/main/exasol/toolbox/util/release/changelog.py#L34

Suggested change

## Feature

## Features

ckunki · 2026-07-13T07:07:30Z

+-------

-The PTB extracts secret names from reusable custom workflow files and exposes them
+The PTB extracts secret names from custom workflow files and exposes them


Suggested change

The PTB extracts secret names from custom workflow files and exposes them

The PTB extracts the names of secrets from custom workflow files and exposes them

ckunki · 2026-07-13T07:10:44Z

+Custom Workflow Metadata
+^^^^^^^^^^^^^^^^^^^^^^^^
+
+The PTB extracts metadata from reusable custom workflow files and exposes it


I like the general and technical description.

Could we, for more straight-forward and impatient users, add a small section with concrete instructions?

What do I need to do?

When? (In which Scenario / Use Case / Problem)

Example, maybe a pointer to one of the PTB's workflow templates illustrating the usage?

ckunki · 2026-07-13T07:15:00Z

+    (% if custom_workflows["merge-gate"].permissions %)
    permissions:
-      contents: read
+      (% for permission_name, permission_level in custom_workflows["merge-gate"].permissions.items() %)


As this pattern repeats 3-4 times - would it make sense to move the functionality into an API function
and in the jinja template only have a call like this (not sure if this is possible)?:

(% workflow_permissions("merge-gate") %)

ckunki · 2026-07-13T07:23:56Z

+        raise ValueError(f"Unknown GitHub permission level: {value!r}")
+
+
+def merge_permissions(permission_maps: list[dict[str, str]]) -> dict[str, str]:


I think I can get the goal of the implementation, but my stomach says there must be a simpler, shorter way.

How about this approach?

Permissions: TypeAlias = dict[str, str] """ Each permission is defined by a name as it key and a value, which is either None, or "read" or "write". """ def merge_permissions(permission_maps: list[Permissions]) -> Permissions: """Merge permission maps to keep the greater permission.""" rank = {None: 0, "read": 1, "write": 2} result = {} def max_permission(perm: str, value: str) -> str: current = result.get(perm) return value if rank[value] > rank[current] else current for other in permission_maps: result |= {p: max_permission(p, v) for p, v in other.items()} return result

No enum required, < 70% characters, tests still green.

ckunki · 2026-07-13T07:40:19Z

    These workflows are seeded by the PTB or extend PTB-provided workflows, but
    they are maintained by the project itself rather than the PTB. See
-    `Custom Workflows <file:///home/chku/git/ptb/.html-documentation/user_guide/features/github_workflows/index.html#custom-workflows>`__.
+    `Custom Workflows <https://exasol.github.io/python-toolbox/main/user_guide/features/github_workflows/index.html#custom-workflows>`__.


Uh - Oh - sorry for this accidental artifact!

ArBridgeman added 5 commits July 9, 2026 10:48

Fix typos in changelogs

7a832d8

Make permissions block present in workflows that call the custom work…

c37d96c

…flows

Add documentation for new feature

5d7f0ed

Add jinja test

620fde3

Prepare config test

24cfb7b

ArBridgeman requested a deployment to manual-approval July 9, 2026 11:58 — with GitHub Actions Waiting

Add extract_permissions

bea075f

ArBridgeman force-pushed the feature/922_make_permissions_configurable_for_custom_workflows branch from 10e54e9 to 3b03bca Compare July 10, 2026 08:53

ArBridgeman requested a deployment to manual-approval July 10, 2026 08:53 — with GitHub Actions Waiting

ArBridgeman requested a deployment to manual-approval July 10, 2026 08:55 — with GitHub Actions Waiting

ArBridgeman added 5 commits July 10, 2026 10:57

Remove not-maintained workflows from get_workflow_templates - need to…

92a1ae4

… be handled separately

Remove now unneeded custom exception as not maintained workflows not …

c3d2872

…in ALL anymore

Remove redundant check

0a36b86

- This is already present in the CLI of the nox sessions workflow:check and workflow:generate - This is already required by the WorkflowOrchestrator which is a pydantic model which restricts WorkflowChoice and hard-code maps it to the right values.

Ensure NOT_MAINTAINED_WORKFLOWS are seeded first

1ac5e10

Tighten wording in documentation

69e8d14

ArBridgeman force-pushed the feature/922_make_permissions_configurable_for_custom_workflows branch from 1eae0d1 to 69e8d14 Compare July 10, 2026 08:58

ArBridgeman temporarily deployed to manual-approval July 10, 2026 08:58 — with GitHub Actions Inactive

ArBridgeman commented Jul 10, 2026

View reviewed changes

chatgpt-codex-connector Bot reviewed Jul 10, 2026

View reviewed changes

Comment thread exasol/toolbox/util/workflows/custom_workflow.py

Comment thread exasol/toolbox/util/workflows/custom_workflow.py

Merge branch 'main' into feature/922_make_permissions_configurable_fo…

30a3ac2

…r_custom_workflows

ArBridgeman temporarily deployed to manual-approval July 10, 2026 12:15 — with GitHub Actions Inactive

ArBridgeman deployed to manual-approval July 10, 2026 12:15 — with GitHub Actions Active

kratz00 reviewed Jul 13, 2026

View reviewed changes

ckunki requested changes Jul 13, 2026

View reviewed changes


		## Feature

		* #922: Extended `custom_workflows` of `github_template_dict` for automatic custom workflow permissions extraction

	def _missing_(cls, value: object) -> PermissionRank:
	def _missing_(cls, value: object) -> Self:

	The PTB extracts secret names from custom workflow files and exposes them
	The PTB extracts the names of secrets from custom workflow files and exposes them

		raise ValueError(f"Unknown GitHub permission level: {value!r}")


		def merge_permissions(permission_maps: list[dict[str, str]]) -> dict[str, str]:

Uh oh!

Conversation

ArBridgeman commented Jul 9, 2026

Checklist

For any Pull Request

When Changes Were Made

When Preparing a Release

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ArBridgeman commented Jul 10, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

sonarqubecloud Bot commented Jul 10, 2026

Quality Gate passed

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants