-
Notifications
You must be signed in to change notification settings - Fork 0
Potential fix for code scanning alert no. 3: Workflow does not contain permissions #121
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
…n permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Pull request overview
This PR addresses a code scanning security alert by adding an explicit permissions block to the test workflow, following the principle of least privilege. The change grants only read access to repository contents, which is sufficient for the workflow's operations (checking out code, running tests, and publishing coverage reports).
Key Changes:
- Added
permissionsblock withcontents: readat the workflow root level
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Pull request overview
Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
Only one file changed, which is not part of the main code. |
lukas-hoermann
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Only one file changed, which is not part of the main code.
Pull Request Test Coverage Report for Build 19834421921Details
💛 - Coveralls |
Potential fix for https://github.com/maurergroup/dfttoolkit/security/code-scanning/3
To fix the problem, you need to add a
permissionsblock to the workflow. This can be done either at the workflow root level (which applies to all jobs unless a job overrides it), or directly within the affected job(s). The best way is to add the following at the root level (just below thename:line and before theon:block):This grants the workflow and all jobs read-only access to repository contents, adhering to the principle of least privilege. If any jobs/actions in the future need further permissions (such as
pull-requests: writeorchecks: write), they can independently specify them at the job level.Suggested fixes powered by Copilot Autofix. Review carefully before merging.