Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| jobs: | ||
| lint: | ||
| uses: valitydev/base-workflows/.github/workflows/basic-linters.yml@v2 | ||
| uses: valitydev/base-workflows/.github/workflows/basic-linters.yml@v1 |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 3 months ago
To address this, you should add a permissions block at the root level of the workflow (top-level in the YAML file), so it applies to all jobs in this workflow unless individually overridden. Since most linters require, at most, contents: read and not write access, the safe minimal setting is:
permissions:
contents: readThis setting provides only the minimum access required for the workflow to read repository contents and does not permit any write operations. Place this block after the name: and before or after the on: section for consistency and clarity, ideally just after the name: entry.
Required changes:
- Add a
permissionsblock withcontents: readat the top level (aftername:and before or afteron:). - No new imports, definitions, or methods are required.
| @@ -1,4 +1,6 @@ | ||
| name: Vality basic linters | ||
| permissions: | ||
| contents: read | ||
|
|
||
| on: | ||
| pull_request: |
3 participants
No description provided.