Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| runs-on: ubuntu-latest | ||
|
|
||
| steps: | ||
| - name: Checkout code | ||
| uses: actions/checkout@v4 | ||
|
|
||
| - name: Build and run retrieval chain | ||
| run: | | ||
| cd samples/retrieval-chain | ||
|
|
||
| # Build the image | ||
| docker build -t retrieval-chain \ | ||
| --build-arg CLIENT_ID="${{ secrets.UIPATH_CLIENT_ID }}" \ | ||
| --build-arg CLIENT_SECRET="${{ secrets.UIPATH_CLIENT_SECRET }}" \ | ||
| --build-arg BASE_URL="${{ secrets.UIPATH_BASE_URL }}" \ | ||
| . | ||
|
|
||
| # Run with parameters | ||
| docker run --rm \ | ||
| -e CLIENT_ID="${{ secrets.UIPATH_CLIENT_ID }}" \ | ||
| -e CLIENT_SECRET="${{ secrets.UIPATH_CLIENT_SECRET }}" \ | ||
| -e BASE_URL="${{ secrets.UIPATH_BASE_URL }}" \ | ||
| retrieval-chain \ | ||
| /app/startup.sh --index_name "${{ github.event.inputs.index_name }}" --query "${{ github.event.inputs.query }}" --k ${{ github.event.inputs.k }} | ||
|
|
||
| - name: Show completion | ||
| run: | | ||
| echo "✅ Retrieval chain completed successfully!" | ||
| echo "📊 Parameters used:" | ||
| echo " - Index: ${{ github.event.inputs.index_name }}" | ||
| echo " - Query: ${{ github.event.inputs.query }}" | ||
| echo " - Results: ${{ github.event.inputs.k }}" |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium test
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 10 months ago
To fix the issue, we will add a permissions block at the root of the workflow file. This block will specify the minimal permissions required for the workflow to function correctly. Based on the workflow's operations, it only needs read access to the repository contents. Therefore, we will set contents: read in the permissions block.
The permissions block will be added directly under the name field in the workflow file to apply to all jobs in the workflow.
| @@ -1,2 +1,4 @@ | ||
| name: Test Retrieval Chain | ||
| permissions: | ||
| contents: read | ||
|
|
| # run: cd samples/retrieval-chain | ||
|
|
||
| - name: Set up Docker Buildx | ||
| uses: docker/setup-buildx-action@v3 |
Check warning
Code scanning / CodeQL
Unpinned tag for a non-immutable Action in workflow Medium
| runs-on: ubuntu-latest | ||
|
|
||
| steps: | ||
| - name: Checkout code | ||
| uses: actions/checkout@v4 | ||
|
|
||
| - name: Set up Docker Buildx | ||
| uses: docker/setup-buildx-action@v3 | ||
|
|
||
| - name: Build Docker image | ||
| run: | | ||
| docker build -t retrieval-chain:test \ | ||
| --build-arg CLIENT_ID="${{ secrets.UIPATH_CLIENT_ID }}" \ | ||
| --build-arg CLIENT_SECRET="${{ secrets.UIPATH_CLIENT_SECRET }}" \ | ||
| --build-arg BASE_URL="${{ secrets.UIPATH_BASE_URL }}" \ | ||
| . | ||
| working-directory: ./samples/retrieval-chain | ||
|
|
||
| - name: Test retrieval chain with default parameters | ||
| run: | | ||
| cd samples/retrieval-chain | ||
| docker run --rm \ | ||
| -e CLIENT_ID="${{ secrets.UIPATH_CLIENT_ID }}" \ | ||
| -e CLIENT_SECRET="${{ secrets.UIPATH_CLIENT_SECRET }}" \ | ||
| -e BASE_URL="${{ secrets.UIPATH_BASE_URL }}" \ | ||
| retrieval-chain:test | ||
|
|
||
| - name: Test retrieval chain with custom parameters | ||
| if: github.event_name == 'workflow_dispatch' | ||
| run: | | ||
| cd samples/retrieval-chain | ||
| docker run --rm \ | ||
| -e CLIENT_ID="${{ secrets.UIPATH_CLIENT_ID }}" \ | ||
| -e CLIENT_SECRET="${{ secrets.UIPATH_CLIENT_SECRET }}" \ | ||
| -e BASE_URL="${{ secrets.UIPATH_BASE_URL }}" \ | ||
| retrieval-chain:test \ | ||
| /app/startup.sh --index_name "${{ github.event.inputs.index_name }}" --query "${{ github.event.inputs.query }}" --k ${{ github.event.inputs.k }} |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 10 months ago
To fix the issue, we need to add a permissions block to the workflow. This block should specify the minimal permissions required for the workflow to function correctly. Since the workflow does not modify the repository, contents: read is sufficient. This ensures the GITHUB_TOKEN has only read access to the repository contents.
The permissions block can be added at the root level of the workflow to apply to all jobs, or it can be added to the specific job (test-retrieval-chain). In this case, adding it at the root level is more concise and ensures consistency across all jobs.
| @@ -8,2 +8,5 @@ | ||
|
|
||
| permissions: | ||
| contents: read | ||
|
|
||
| jobs: |
2 participants
Development Package