fix: set canary release on demand #128
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| name: Verify | ||
| uses: ./.github/workflows/verify.yml | ||
| secrets: inherit |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI about 1 month ago
To address the flagged issue, add an explicit permissions key at the workflow level (top-level, above jobs:) in .github/workflows/ci.yml. This ensures that all jobs in the workflow—unless they declare their own permissions—receive only the minimum GitHub token capabilities necessary. As a safe “minimal starting point”, set contents: read (which covers most cases where jobs only need to read from the repository). If you know exactly what permissions your workflow needs (for example, writing pull-requests), you may grant those instead. However, without further context, the minimal and safest fix is to add:
permissions:
contents: readEasily implementable by inserting this block above the jobs: key, between lines 10 and 11.
| @@ -8,6 +8,8 @@ | ||
| group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }} | ||
| cancel-in-progress: true | ||
|
|
||
| permissions: | ||
| contents: read | ||
| jobs: | ||
| verify: | ||
| name: Verify |
No description provided.