Up 3 1 7 #57
Up 3 1 7 #57
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| jobs: | ||
| build: | ||
| uses: valitydev/java-workflow/.github/workflows/maven-service-build.yml@v2 | ||
| uses: valitydev/java-workflow/.github/workflows/maven-service-build.yml@v3 |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 5 months ago
To fix the issue, explicitly set a permissions block at either the workflow or job level in .github/workflows/build.yml. Since the workflow only contains a single job, it makes sense to add the permissions block at the root level, so all jobs inherit it. The minimal starting point recommended by CodeQL is simply {} (no permissions), but you may want to set contents: read if, for example, your jobs need to check out code. Place the following block under the name: field and before the on: trigger:
permissions:
contents: readThis lets the workflow access repository contents, which is usually required for build jobs. If you know that more or fewer permissions are needed, adjust accordingly. Only lines in .github/workflows/build.yml need to be changed.
| @@ -1,4 +1,6 @@ | ||
| name: Maven Build Artifact | ||
| permissions: | ||
| contents: read | ||
|
|
||
| on: | ||
| pull_request: |
No description provided.