Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v3 | ||
| - uses: alstr/todo-to-issue-action@v4 | ||
| with: | ||
| TOKEN: ${{ secrets.GITHUB_TOKEN }} |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 10 months ago
To fix the issue, we need to add a permissions block to the workflow. Since the workflow uses the alstr/todo-to-issue-action@v4 action, which likely interacts with issues, we should grant the minimal required permissions. Based on the action's purpose, it likely needs contents: read to access the repository and issues: write to create or modify issues. These permissions should be added at the workflow level to apply to all jobs unless overridden.
| @@ -9,2 +9,6 @@ | ||
|
|
||
| permissions: | ||
| contents: read | ||
| issues: write | ||
|
|
||
| jobs: | ||
| @@ -17,2 +21 @@ | ||
| TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
|
|
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v3 | ||
| - uses: alstr/todo-to-issue-action@v4 |
Check warning
Code scanning / CodeQL
Unpinned tag for a non-immutable Action in workflow Medium
1 participant
Summary
Testing
npm test