Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| name: Dependency Scan | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: "Checkout repository" | ||
| uses: actions/checkout@v4 | ||
|
|
||
| - name: "Scan for dependencies" | ||
| uses: github/dependabot-action@v2 | ||
| with: | ||
| sub-directory: "/" | ||
| open-pull-requests-limit: 5 | ||
| package-ecosystem: "github-actions" | ||
| directory: "/" | ||
|
|
||
| secret-scan: |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 6 months ago
To fix the problem, add a permissions block to the dependency-scan job in .github/workflows/codeql.yml. This block should grant only the minimal required permissions. Since the job only checks out code and runs a dependency scan, contents: read is sufficient. The permissions block should be added at the same indentation level as runs-on and steps within the dependency-scan job, ideally immediately after runs-on for clarity.
| @@ -51,6 +51,8 @@ | ||
| dependency-scan: | ||
| name: Dependency Scan | ||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| contents: read | ||
| steps: | ||
| - name: "Checkout repository" | ||
| uses: actions/checkout@v4 |
| name: "Secret Scan" | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: "Checkout" | ||
| uses: actions/checkout@v4 | ||
|
|
||
| - name: "Scan for secrets" | ||
| uses: github/secret-scanning@v2 |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 6 months ago
To fix the problem, we should add a permissions block to the secret-scan job in .github/workflows/codeql.yml. This block should specify the minimal permissions required for the job to function correctly. Since the job only checks out code and runs a secret scanning action, it only needs read access to repository contents. Therefore, we should add permissions: contents: read under the secret-scan job, at the same indentation level as name and runs-on. No other changes are required.
| @@ -66,6 +66,8 @@ | ||
| secret-scan: | ||
| name: "Secret Scan" | ||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| contents: read | ||
| steps: | ||
| - name: "Checkout" | ||
| uses: actions/checkout@v4 |
1 participant
No description provided.