[mchromin]

No description provided.

[Copilot]

Pull request overview

This PR updates the CI/CD configuration by replacing legacy workflow files with reusable workflow references from the intel/mfd repository. The changes consolidate build, test, and code quality checks while removing redundant workflow definitions, and include minor test code formatting improvements.

Key changes:

• Replaces local workflow definitions with references to centralized reusable workflows from intel/mfd/.github/workflows/
• Adds new workflow files for dependency review, code standards, and test execution
• Removes the legacy build_upload_whl.yml reusable workflow
• Updates test file formatting for better readability

Reviewed changes

Copilot reviewed 14 out of 14 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
.github/workflows/run_tests.yml	New workflow for running unit and functional tests with Python 3.10 and 3.13 on Ubuntu and Windows
.github/workflows/pull_requests.yml	Removed legacy pull request workflow
.github/workflows/pull_request.yml	New simplified pull request workflow using reusable workflow
.github/workflows/manual_release.yml	Updated release workflow to use centralized reusable workflow with new parameter structure
.github/workflows/main.yml	New main branch build workflow using reusable workflow
.github/workflows/dependency_review.yml	New workflow for dependency review on pull requests
.github/workflows/codeql.yml	Simplified CodeQL workflow to use reusable workflow
.github/workflows/check_pr_format.yml	New workflow for validating PR titles and commits
.github/workflows/check_code_standard.yml	New workflow for code standard checks
.github/workflows/build_upload_whl.yml	Removed legacy reusable workflow definition
.github/dependency_review.yml	New configuration for dependency review settings
.github/dependabot.yml	New Dependabot configuration for pip dependencies
tests/unit/test_mfd_package_manager/test_windows.py	Reformatted multi-line Mock return value for better readability
tests/unit/test_mfd_package_manager/test_linux.py	Condensed ConnectionCompletedProcess instantiation to single line

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

In general, the fix is to explicitly specify a minimal permissions block for the workflow or individual jobs so that the GITHUB_TOKEN has only the scopes needed. For a code-style/standards check that runs on pull requests and reuses another workflow, read access to the repository contents is typically sufficient, and no write permissions are required.

The best fix here, without altering existing functionality, is to add a permissions block at the workflow root level so it applies to all jobs that don’t override it. Directly under the name: (before on:) or directly under on: (but at the root indentation), add:

permissions:
  contents: read

This grants read-only access to repository contents, which is needed for checking code, and avoids any write permissions. Concretely, in .github/workflows/check_code_standard.yml, insert the permissions block between line 2 (the blank line) and line 3 (on:), adjusting indentation to match root-level keys. No imports or additional methods are needed; this is a pure YAML configuration change.

In general, you fix this by explicitly defining a permissions block to scope the GITHUB_TOKEN to only what is needed. For a workflow that merely validates PR titles/commits via a reusable workflow, read-only repository contents are typically sufficient at the top level; if the reusable workflow needs more, it can request them itself.

The single best fix here, without changing existing functionality, is to add a minimal permissions block at the workflow level (top-level key alongside name and on). A safe default is contents: read, which allows reading repository content and PR metadata but disallows writes. This block will apply to all jobs (including the validate_pr_format job that uses the reusable workflow) unless overridden. Concretely, in .github/workflows/check_pr_format.yml, insert:

permissions:
  contents: read

between the name: and on: keys (around lines 1–3). No imports or other definitions are needed, as this is pure workflow configuration.

To fix the problem, explicitly restrict the GITHUB_TOKEN permissions in this workflow instead of relying on repository defaults. The minimal safe, generally applicable configuration for a dependency review job is to grant read access to repository contents, which is what GitHub’s own dependency-review-action examples use.

The single best way to fix this while preserving existing behavior is to add a permissions block under the dependency_review job (the job that uses the reusable workflow). This way, only this job gets the defined permissions, and you don’t inadvertently affect other workflows. Concretely, in .github/workflows/dependency_review.yml, under jobs: dependency_review:, insert:

permissions:
  contents: read

so that the job explicitly says it only needs read access to repository contents. No additional imports, methods, or other definitions are required; this is purely a YAML configuration change inside the existing workflow.

---

In general, fix this by explicitly defining a permissions block either at the root of the workflow (applies to all jobs without their own permissions) or at the individual job level. Start from the most restrictive reasonable default (often contents: read) and only grant additional write permissions if the workflow actually needs them.

For this specific file (.github/workflows/main.yml), we should add a workflow-level permissions block just under the name: (and before on:) so it applies to the build_whl job, which delegates to a reusable workflow. Since we cannot see the internals of intel/mfd/.github/workflows/main.yml@main, the safest minimal useful default is:

permissions:
  contents: read

This gives the reusable workflow read access to repository contents (commonly needed to check out code) but avoids granting write scopes. If the reusable workflow requires broader permissions, they can be added later, but the CodeQL warning will already be addressed with this explicit restriction. No imports or other files are involved; we only modify .github/workflows/main.yml.

In general, the fix is to explicitly declare a permissions block at the workflow (top-level) or job level, limiting the GITHUB_TOKEN to the minimal rights required. Because this workflow only delegates to a reusable workflow and does not itself perform write operations, a conservative starting point is contents: read at the top level, which will apply to all jobs unless overridden.

The best fix with minimal functional impact is to add a top-level permissions section after the name: (or before jobs:) in .github/workflows/pull_request.yml. We will set contents: read, which is typically sufficient for CI tasks like checking out code and reading repository contents. If the reusable workflow ever needs additional scopes, they can be added explicitly later, but we should not assume write access is required.

Concretely, in .github/workflows/pull_request.yml, insert:

permissions:
  contents: read

between line 2 and line 3 (after name: Dev Build and the blank line). No imports or additional definitions are required; this is purely a YAML configuration change inside the workflow file and does not affect the rest of the codebase.

In general, the fix is to explicitly declare a permissions block either at the workflow root (applies to all jobs) or at the specific job that runs the tests. That block should grant only the minimal permissions needed, typically contents: read for a test workflow that just checks out code and calls a reusable workflow. If the reusable workflow needs additional scopes, they can be added explicitly later.

For this specific file, the safest, non‑functional change is to add a permissions block under the run_tests job. This limits the GITHUB_TOKEN to read-only access to repository contents while leaving the rest of the job configuration untouched. Concretely, in .github/workflows/run_tests.yml, within the jobs.run_tests definition, insert:

permissions:
  contents: read

with two spaces of indentation (aligned under run_tests: and at the same level as strategy: and uses:). No imports or additional definitions are needed.

[mfd-intel-bot]

We don't publish DEVs .whl.
To build .whl, run 'pip install git+https://intel/mfd-package-manager@ci'