Workflows #13
Workflows #13
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| if: github.ref_type == 'tag' | ||
| name: Run linter and tests | ||
| uses: ./.github/workflows/Lint-and-test.yml | ||
| build: |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions
This autofix suggestion was applied.
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 6 months ago
To fix the issue, we will add a permissions block to the lint-and-test job. Since this job does not appear to require write access, we will set the permissions to contents: read, which is the minimal required permission for most workflows. This change ensures that the job has only the access it needs, reducing the risk of misuse.
| @@ -5,2 +5,4 @@ | ||
| if: github.ref_type == 'tag' | ||
| permissions: | ||
| contents: read | ||
| name: Run linter and tests |
rerpha
committed this autofix suggestion 6 months ago.
| needs: lint-and-test | ||
| if: github.ref_type == 'tag' | ||
| name: build distribution | ||
| runs-on: ubuntu-latest | ||
|
|
||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| with: | ||
| fetch-depth: 0 | ||
|
|
||
| - uses: actions/setup-python@v5 | ||
| with: | ||
| python-version: "3.x" | ||
|
|
||
| - name: Build release distributions | ||
| run: | | ||
| # NOTE: put your own distribution build steps here. | ||
| python -m pip install build | ||
| python -m build | ||
| - name: Upload distributions | ||
| uses: actions/upload-artifact@v4 | ||
| with: | ||
| name: release-dists | ||
| path: dist/ | ||
|
|
||
| pypi-publish: | ||
| - uses: actions/checkout@v4 | ||
| - name: Set up Python | ||
| uses: actions/setup-python@v5 | ||
| with: | ||
| python-version: "3.11" | ||
| - name: Install pypa/build | ||
| run: >- | ||
| python3 -m | ||
| pip install | ||
| build | ||
| --user | ||
| - name: Build a binary wheel and a source tarball | ||
| run: python3 -m build | ||
| - name: Store the distribution packages | ||
| uses: actions/upload-artifact@v4 | ||
| with: | ||
| name: python-package-distributions | ||
| path: dist/ | ||
| publish-to-pypi: |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 6 months ago
To fix the issue, we need to add explicit permissions blocks to the lint-and-test and build jobs. These permissions should be scoped to the minimum required for the jobs to function correctly. Since these jobs do not appear to require write access, we can set contents: read as the minimal permission.
- Add a
permissionsblock to thelint-and-testjob, specifyingcontents: read. - Add a
permissionsblock to thebuildjob, specifyingcontents: read.
| @@ -6,2 +6,4 @@ | ||
| name: Run linter and tests | ||
| permissions: | ||
| contents: read | ||
| uses: ./.github/workflows/Lint-and-test.yml | ||
| @@ -12,2 +14,4 @@ | ||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| contents: read | ||
|
|
…n permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
No description provided.