Prettify and random ordering of MIDIWeb-Hub sites, sort by name.#7
Prettify and random ordering of MIDIWeb-Hub sites, sort by name.#7
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| runs-on: ubuntu-latest | ||
|
|
||
| steps: | ||
| - name: Checkout | ||
| uses: actions/checkout@v4 | ||
|
|
||
| - name: Setup Node | ||
| uses: actions/setup-node@v4 | ||
| with: | ||
| node-version: 20 | ||
| cache: npm | ||
|
|
||
| - name: Install dependencies | ||
| run: npm ci | ||
|
|
||
| - name: Check src/data.ts formatting | ||
| run: | | ||
| npm run check:data || { | ||
| echo "::error title=src/data.ts formatting::Run 'npm run format:data', commit the updated src/data.ts, and push again." | ||
| exit 1 | ||
| } |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 3 days ago
In general, the problem is fixed by explicitly declaring a minimal permissions: block in the workflow or job, instead of inheriting broad defaults. For a style/formatting check job that only needs to read the repository contents, we can safely restrict GITHUB_TOKEN to contents: read.
The best fix here is to add a workflow-level permissions: block right under the name: (or at least before jobs:). This will apply to all jobs that don’t override it. Given the current steps, the job only needs to check out code and install dependencies, so contents: read is sufficient. No functionality changes are introduced because none of the steps requires write permissions or access to other resources (issues, pull requests, packages, etc.).
Concretely, in .github/workflows/data-style.yml, insert:
permissions:
contents: readafter line 1 (name: Validate data style) and before the on: block. No additional imports or methods are required, as this is a pure YAML configuration change.
| @@ -1,5 +1,8 @@ | ||
| name: Validate data style | ||
|
|
||
| permissions: | ||
| contents: read | ||
|
|
||
| on: | ||
| pull_request: | ||
| paths: |
2 participants
No description provided.