Skip to content

.github/workflows: build gmsl kuiper image #239

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
iristeiu06 wants to merge 1 commit into
base: main
Choose a base branch
from
+14 −0
Open

.github/workflows: build gmsl kuiper image #239

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 14 additions & 0 deletions .github/workflows/gmsl-image-build.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,14 @@
name: GMSL Kuiper Image Build
on:
workflow_dispatch:
inputs:
linux_run_id:
description: 'Run ID of the linux kernel build workflow'
required: true
type: string

jobs:
build:
runs-on: ubuntu-latest
steps:
- run: echo "Start Kuiper Image Build."
Comment on lines +12 to +14

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {}

Copilot Autofix

AI about 2 months ago

In general, the fix is to explicitly define a permissions: block for the workflow or for the build job so that the automatically-provided GITHUB_TOKEN has only the minimal required scope. For this particular workflow, the job only prints a message and does not interact with the repository or GitHub APIs, so it can safely run with fully disabled permissions (permissions: {}) or with a minimal read-only scope like contents: read. Using permissions: {} is the strictest option and clearly documents that the token is not intended to be used.

The single best way to fix this without changing existing functionality is to add a top-level permissions: block (so it applies to all current and future jobs in this workflow) between the on: block and the jobs: block. We will set it to an empty mapping, which disables all default scopes for the GITHUB_TOKEN in this workflow:

permissions: {}

Concretely, in .github/workflows/gmsl-image-build.yml, insert this permissions: line after the on: configuration (after line 8/9 in the provided snippet) and before jobs:. No imports or additional definitions are needed; this is purely YAML configuration for the GitHub Actions workflow.

Suggested changeset 1
.github/workflows/gmsl-image-build.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/gmsl-image-build.yml b/.github/workflows/gmsl-image-build.yml
--- a/.github/workflows/gmsl-image-build.yml
+++ b/.github/workflows/gmsl-image-build.yml
@@ -7,6 +7,7 @@
         required: true
         type: string
 
+permissions: {}
 jobs:
   build:
     runs-on: ubuntu-latest
EOF
@@ -7,6 +7,7 @@
required: true
type: string

permissions: {}
jobs:
build:
runs-on: ubuntu-latest
Copilot is powered by AI and may make mistakes. Always verify output.
Loading