Add publish test work flow to be used before real workflow#116
Add publish test work flow to be used before real workflow#116orlando-woscholski wants to merge 3 commits intomainfrom
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| name: Build wheels on ${{ matrix.os }} | ||
| runs-on: ${{ matrix.os }} | ||
| strategy: | ||
| matrix: | ||
| os: [ubuntu-latest, macos-latest, windows-latest] | ||
|
|
||
| steps: | ||
| - uses: actions/checkout@v4 | ||
|
|
||
| - name: Build wheels | ||
| uses: pypa/cibuildwheel@v2.22.0 | ||
| env: | ||
| CIBW_BUILD: "cp310-* cp311-* cp312-* cp313-*" | ||
| CIBW_SKIP: "*-manylinux_i686 *-musllinux_*" | ||
| CIBW_BEFORE_ALL: "pip install cmake" | ||
|
|
||
| - uses: actions/upload-artifact@v4 | ||
| with: | ||
| name: wheels-${{ matrix.os }} | ||
| path: ./wheelhouse/*.whl | ||
|
|
||
| publish: |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI about 2 months ago
In general, to fix this issue you should explicitly set a permissions block either at the workflow root or per job, granting only the scopes needed. For a build-only job that checks out code and uploads artifacts, contents: read is usually sufficient, while artifact upload/download rely on the actions permission which is implicitly handled by GitHub and does not need write to contents.
The best minimal fix here is to add a permissions block to the build_wheels job (lines 7–28) so that it uses contents: read. This matches CodeQL’s suggested minimal starting point and does not change existing functionality: actions/checkout@v4 still works with contents: read, and actions/upload-artifact@v4 uses its own scope. The publish job already has a permissions block (id-token: write), so it does not need changes.
Concretely, in .github/workflows/publish.yaml, under build_wheels: (after runs-on: ${{ matrix.os }} or before strategy:), insert:
permissions:
contents: readNo imports or additional definitions are needed; this is purely a YAML workflow configuration change.
| @@ -7,6 +7,8 @@ | ||
| build_wheels: | ||
| name: Build wheels on ${{ matrix.os }} | ||
| runs-on: ${{ matrix.os }} | ||
| permissions: | ||
| contents: read | ||
| strategy: | ||
| matrix: | ||
| os: [ubuntu-latest, macos-latest, windows-latest] |
3 participants
stupid GitHub won't let me run this action without having it in main